Bug 1018490 - btrfs segfaults when deleting subvolume with very long name
btrfs segfaults when deleting subvolume with very long name
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: btrfs-progs (Show other bugs)
7.0
All Linux
medium Severity medium
: rc
: ---
Assigned To: fs-maint
Filesystem QE
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-10-12 11:55 EDT by Eryu Guan
Modified: 2014-01-27 03:05 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-01-27 03:05:01 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Eryu Guan 2013-10-12 11:55:33 EDT
Description of problem:
I hit a segfault when deleting a subvolume with very long name(>4096),
it's because cmd_subvol_delete() calls strdup() and passes NULL as
argument, which is returned by realpath(3).

I used the following script to reproduce

        #!/bin/bash
        mnt=$1
        i=1
        path=$mnt/subvol_$i

        # Create very deep subvolumes
        while btrfs sub create $path;do
              ((i++))
              path="$path/subvol_$i"
        done
        last_vol=$(dirname $path)
        dir=$(dirname $last_vol)
        vol=$(basename $last_vol)

        # Try to delete tha last one, this would get segfault
        pushd $dir
        btrfs sub delete $vol
        popd

Version-Release number of selected component (if applicable):
btrfs-progs-0.20.rc1.20130917git194aa4a-1.el7

How reproducible:
always

Steps to Reproduce:
1. see description
2.
3.

Actual results:
btrfs segfaults

Expected results:
subvolume can be deleted

Additional info:
Comment 1 Eryu Guan 2013-10-12 12:00:44 EDT
I proposed a patch to try to fix it.

http://www.mail-archive.com/linux-btrfs@vger.kernel.org/msg27912.html
Comment 2 Eric Sandeen 2013-10-12 13:16:59 EDT
Doesn't appear to be fixed in btrfs-progs-devel, either.
Comment 3 Eryu Guan 2014-01-27 03:05:01 EST
No segfault in v3.12, closed as CURRENTRELEASE.

Note You need to log in before you can comment on or make changes to this bug.