From 6dd93e9e5eb19e81a74b3df8426a945a08ad8a1f Mon Sep 17 00:00:00 2001 From: Eric Sandeen Date: Wed, 31 Jul 2013 20:18:54 -0500 Subject: [PATCH] xfs: avoid double-free in xfs_attr_node_addname xfs_attr_node_addname()'s error handling tests whether it should free "state" in the out: error handling label: out: if (state) xfs_da_state_free(state); but an earlier free doesn't set state to NULL afterwards; this could lead to a double free. Fix it by setting state to NULL after it's freed. This was found by Coverity. Signed-off-by: Eric Sandeen Reviewed-by: Mark Tinguely Signed-off-by: Ben Myers --- fs/xfs/xfs_attr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c index 176dbb66282d..ddcf2267ffa6 100644 --- a/fs/xfs/xfs_attr.c +++ b/fs/xfs/xfs_attr.c @@ -1014,6 +1014,7 @@ restart: * have been a b-tree. */ xfs_da_state_free(state); + state = NULL; xfs_bmap_init(args->flist, args->firstblock); error = xfs_attr3_leaf_to_node(args); if (!error) { -- 2.20.1