File 0005-fix-use-after-free.patch of Package btrfsprogs

Overview Repositories Revisions Requests Users Attributes Meta

File 0005-fix-use-after-free.patch of Package btrfsprogs (Revision 9764c67f8b400d2e4e62a5c728672061)

Currently displaying revision 9764c67f8b400d2e4e62a5c728672061 , Show latest

From: Jeff Mahoney <jeffm@suse.com>
Subject: btrfsprogs: Fix use after free in close_ctree
References: bnc#603620

After the roots are closed, root is freed. Yet close_ctree continues
 to use it. It works generally because no new memory is allocated in
 the interim, but with glibc malloc perturbing enabled, it crashes
 every time. This is because root->fs_info points to garbage.

This patch uses the already-cached fs_info variable for the rest of
 the accesses and fixes the crash.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
---
 disk-io.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/disk-io.c
+++ b/disk-io.c
@@ -971,13 +971,13 @@ int close_ctree(struct btrfs_root *root)
 	if (fs_info->csum_root->node)
 		free_extent_buffer(fs_info->csum_root->node);
 
-	if (root->fs_info->log_root_tree) {
-		if (root->fs_info->log_root_tree->node)
-			free_extent_buffer(root->fs_info->log_root_tree->node);
-		free(root->fs_info->log_root_tree);
+	if (fs_info->log_root_tree) {
+		if (fs_info->log_root_tree->node)
+			free_extent_buffer(fs_info->log_root_tree->node);
+		free(fs_info->log_root_tree);
 	}
 
-	close_all_devices(root->fs_info);
+	close_all_devices(fs_info);
 	extent_io_tree_cleanup(&fs_info->extent_cache);
 	extent_io_tree_cleanup(&fs_info->free_space_cache);
 	extent_io_tree_cleanup(&fs_info->block_group_cache);

Places

File 0005-fix-use-after-free.patch of Package btrfsprogs (Revision 9764c67f8b400d2e4e62a5c728672061)

Places