diff mbox series

btrfs-progs: cmd-subvolume: set subvol_path to NULL after free

Message ID 20201207090755.16161-1-l@damenly.su (mailing list archive)
State New, archived
Headers show
Series btrfs-progs: cmd-subvolume: set subvol_path to NULL after free | expand

Commit Message

Su Yue Dec. 7, 2020, 9:07 a.m. UTC
User reported that `btrfs subvolume show -u -- /mnt` causes double free.


Pointer subovl_path was freed in iterations but still keeps old value.
In the last iteration, error BTRFS_UTIL_ERROR_STOP_ITERATION returned,
then the double free of subvol_path happens in the out goto label.

Set subvol_path to NULL after each free() in the loop to fix the issue.

Links: https://github.com/kdave/btrfs-progs/issues/317
Signed-off-by: Su Yue <l@damenly.su>
---
 cmds/subvolume.c | 1 +
 1 file changed, 1 insertion(+)

Comments

David Sterba Dec. 10, 2020, 4:13 p.m. UTC | #1
On Mon, Dec 07, 2020 at 05:07:55PM +0800, Su Yue wrote:
> User reported that `btrfs subvolume show -u -- /mnt` causes double free.
> 
> 
> Pointer subovl_path was freed in iterations but still keeps old value.
> In the last iteration, error BTRFS_UTIL_ERROR_STOP_ITERATION returned,
> then the double free of subvol_path happens in the out goto label.
> 
> Set subvol_path to NULL after each free() in the loop to fix the issue.
> 
> Links: https://github.com/kdave/btrfs-progs/issues/317
> Signed-off-by: Su Yue <l@damenly.su>

Thanks, added to devel.
diff mbox series

Patch

diff --git a/cmds/subvolume.c b/cmds/subvolume.c
index f153cfa9..a6771d10 100644
--- a/cmds/subvolume.c
+++ b/cmds/subvolume.c
@@ -1117,6 +1117,7 @@  static int cmd_subvol_show(const struct cmd_struct *cmd, int argc, char **argv)
 				break;
 
 			free(subvol_path);
+			subvol_path = NULL;
 		}
 		btrfs_util_destroy_subvolume_iterator(iter);
 	} else {