• slyich@gmail.com's avatar
    btrfs: fix double-free 'tree_root' in 'btrfs_mount()' · 45ea6095
    slyich@gmail.com authored
    On error path 'tree_root' is treed in 'free_fs_info()'.
    No need to free it explicitely. Noticed by SLUB in debug mode:
    
    Complete reproducer under usermode linux (discovered on real
    machine):
    
        bdev=/dev/ubda
        btr_root=/btr
        /mkfs.btrfs $bdev
        mount $bdev $btr_root
        mkdir $btr_root/subvols/
        cd $btr_root/subvols/
        /btrfs su cr foo
        /btrfs su cr bar
        mount $bdev -osubvol=subvols/foo $btr_root/subvols/bar
        umount $btr_root/subvols/bar
    
    which gives
    
    device fsid 4d55aa28-45b1-474b-b4ec-da912322195e devid 1 transid 7 /dev/ubda
    =============================================================================
    BUG kmalloc-2048: Object already free
    -----------------------------------------------------------------------------
    
    INFO: Allocated in btrfs_mount+0x389/0x7f0 age=0 cpu=0 pid=277
    INFO: Freed in btrfs_mount+0x51c/0x7f0 age=0 cpu=0 pid=277
    INFO: Slab 0x0000000062886200 objects=15 used=9 fp=0x0000000070b4d2d0 flags=0x4081
    INFO: Object 0x0000000070b4d2d0 @offset=21200 fp=0x0000000070b4a968
    ...
    Call Trace:
    70b31948:  [<6008c522>] print_trailer+0xe2/0x130
    70b31978:  [<6008c5aa>] object_err+0x3a/0x50
    70b319a8:  [<6008e242>] free_debug_processing+0x142/0x2a0
    70b319e0:  [<600ebf6f>] btrfs_mount+0x55f/0x7f0
    70b319f8:  [<6008e5c1>] __slab_free+0x221/0x2d0
    Signed-off-by: default avatarSergei Trofimovich <slyfox@gentoo.org>
    Cc: Arne Jansen <sensille@gmx.net>
    Cc: Chris Mason <chris.mason@oracle.com>
    Cc: David Sterba <dsterba@suse.cz>
    Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
    45ea6095
super.c 34.7 KB