Commit 6dd93e9e authored Jul 31, 2013 by Eric Sandeen Committed by Ben Myers Aug 13, 2013

xfs: avoid double-free in xfs_attr_node_addname



xfs_attr_node_addname()'s error handling tests whether it
should free "state" in the out: error handling label:

out:
        if (state)
                xfs_da_state_free(state);

but an earlier free doesn't set state to NULL afterwards; this
could lead to a double free.  Fix it by setting state to NULL
after it's freed.

This was found by Coverity.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>

parent 2c2bcc07

fs/xfs/xfs_attr.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1014,6 +1014,7 @@ xfs_attr_node_addname(xfs_da_args_t *args)
		* have been a b-tree.
		*/
		xfs_da_state_free(state);
		state = NULL;
		xfs_bmap_init(args->flist, args->firstblock);
		error = xfs_attr3_leaf_to_node(args);
		if (!error) {