marko10_000
/
btrfs-progs
forked from Mirrors/btrfs-progs
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

btrfs-progs: rescue-super: don't double free fs_devices 

[BUG]
During fuzz/007 we hit the following error:

  ====== RUN MAYFAIL btrfs rescue super-recover -y -v tests/fuzz-tests/images/bko-200409.raw.restored.scratch
  ERROR: tree_root block unaligned: 33554431
  ERROR: superblock checksum matches but it has invalid members
  ERROR: tree_root block unaligned: 33554431
  ERROR: superblock checksum matches but it has invalid members
  ERROR: tree_root block unaligned: 33554431
  ERROR: superblock checksum matches but it has invalid members
  ERROR: failed to add chunk map start=12582912 len=8454144: -17 (File exists)
  Couldn't read chunk tree
  failed (ignored, ret=139): btrfs rescue super-recover -y -v tests/fuzz-tests/images/bko-200409.raw.restored.scratch
  mayfail: returned code 139 (SEGFAULT), not ignored
  test failed for case 007-simple-super-recover

[CAUSE]
In __open_ctree_fd(), if we have valid @open_ctree_flags and
btrfs_scan_fs_devices() succeeds without problems, no matter what
happens we will call btrfs_close_devices(), thus free all related
devices.

In super-recover, before we call open_ctree(), we have called
btrfs_scan_fs_devices() already, so btrfs_scan_fs_devices() should not
fail in open_ctree(), fs_devices will always be freed in open_ctree() or
close_ctree().

[FIX]
So in super-recover.c, we should not call btrfs_close_devices(), or we
will find fs_devices->list freed, and trigger segfault when exiting.

Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
master
Qu Wenruo 2018-08-03 13:50:22 +08:00 committed by David Sterba
parent 40073c3ca9
commit 5d24e630b0
1 changed files with 0 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
super-recover.c
View File

@ -292,9 +292,6 @@ int btrfs_recover_superblocks(const char *dname,
no_recover:
recover_err_str(ret);
free_recover_superblock(&recover);
/* check if we have freed fs_devices in close_ctree() */
if (!root)
btrfs_close_devices(recover.fs_devices);
return ret;
}