Hi,
This patch fixes a double-free bug that can occur when errors are found
in an inode and later, it's freed. The problem is that function
free_metalist was using osi_list_del when removing buffer_heads from the
inode in memory. It should be using osi_list_del_init so that the list
head is reinitialized. Otherwise the list head is left with an unknown
value which gets interpreted later on as !list_empty(), so it tries to
free the list a second time.
This also fixes a minor issue with function rangecheck_jmeta, which
frees the buffer_head when it's done. The patch sets the returned *bh
value back to NULL to ensure it's not reused. This is just a precaution
I spotted while debugging, and it's worth doing.
Regards,
Bob Peterson
Red Hat File Systems
Signed-off-by: Bob Peterson <rpete...@redhat.com>
---
diff --git a/gfs2/fsck/fs_recovery.c b/gfs2/fsck/fs_recovery.c
index 3d8fe98..095d118 100644
--- a/gfs2/fsck/fs_recovery.c
+++ b/gfs2/fsck/fs_recovery.c
@@ -631,6 +631,7 @@ static int rangecheck_jmeta(struct gfs2_inode *ip, uint64_t
block,
(unsigned long long)block,
(unsigned long long)block);
brelse(*bh);
+ *bh = NULL;
return meta_skip_further;
}
}
diff --git a/gfs2/fsck/metawalk.c b/gfs2/fsck/metawalk.c
index 1875b24..16faafb 100644
--- a/gfs2/fsck/metawalk.c
+++ b/gfs2/fsck/metawalk.c
@@ -1203,7 +1203,7 @@ static void free_metalist(struct gfs2_inode *ip,
osi_list_t *mlp)
nbh = osi_list_entry(list->next,
struct gfs2_buffer_head,
b_altlist);
if (nbh == ip->i_bh)
- osi_list_del(&nbh->b_altlist);
+ osi_list_del_init(&nbh->b_altlist);
else
brelse(nbh);
}
