Bug 1018490 - btrfs segfaults when deleting subvolume with very long name
Summary: btrfs segfaults when deleting subvolume with very long name
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: btrfs-progs
Version: 7.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: fs-maint
QA Contact: Filesystem QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-10-12 15:55 UTC by Eryu Guan
Modified: 2014-01-27 08:05 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-01-27 08:05:01 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Eryu Guan 2013-10-12 15:55:33 UTC
Description of problem:
I hit a segfault when deleting a subvolume with very long name(>4096),
it's because cmd_subvol_delete() calls strdup() and passes NULL as
argument, which is returned by realpath(3).

I used the following script to reproduce

        #!/bin/bash
        mnt=$1
        i=1
        path=$mnt/subvol_$i

        # Create very deep subvolumes
        while btrfs sub create $path;do
              ((i++))
              path="$path/subvol_$i"
        done
        last_vol=$(dirname $path)
        dir=$(dirname $last_vol)
        vol=$(basename $last_vol)

        # Try to delete tha last one, this would get segfault
        pushd $dir
        btrfs sub delete $vol
        popd

Version-Release number of selected component (if applicable):
btrfs-progs-0.20.rc1.20130917git194aa4a-1.el7

How reproducible:
always

Steps to Reproduce:
1. see description
2.
3.

Actual results:
btrfs segfaults

Expected results:
subvolume can be deleted

Additional info:

Comment 1 Eryu Guan 2013-10-12 16:00:44 UTC
I proposed a patch to try to fix it.

http://www.mail-archive.com/linux-btrfs@vger.kernel.org/msg27912.html

Comment 2 Eric Sandeen 2013-10-12 17:16:59 UTC
Doesn't appear to be fixed in btrfs-progs-devel, either.

Comment 3 Eryu Guan 2014-01-27 08:05:01 UTC
No segfault in v3.12, closed as CURRENTRELEASE.


Note You need to log in before you can comment on or make changes to this bug.