From 2a4c4bf2fceea879c4b889df2d88ff3ce1f98398 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 28 Sep 2020 07:24:02 +0000 Subject: [PATCH] filesystem: Double close (USE_AFTER_FREE) CID 226484 (#1 of 1): Double close (USE_AFTER_FREE) Calling close(int) closes handle fd which has already been closed. Signed-off-by: Adrian Reber --- criu/filesystems.c | 1 - criu/util.c | 8 +++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/criu/filesystems.c b/criu/filesystems.c index d76b18291..fc53f4e5d 100644 --- a/criu/filesystems.c +++ b/criu/filesystems.c @@ -656,7 +656,6 @@ static int dump_empty_fs(struct mount_info *pm) return fd; ret = is_empty_dir(fd); - close(fd); if (ret < 0) { pr_err("%s isn't empty\n", pm->fstype->name); return -1; diff --git a/criu/util.c b/criu/util.c index a88da8d03..c610da7b3 100644 --- a/criu/util.c +++ b/criu/util.c @@ -709,6 +709,10 @@ int is_root_user(void) return 1; } +/* + * is_empty_dir will always close the FD dirfd: either implicitly + * via closedir or explicitly in case fdopendir had failed + */ int is_empty_dir(int dirfd) { int ret = 0; @@ -716,8 +720,10 @@ int is_empty_dir(int dirfd) struct dirent *de; fdir = fdopendir(dirfd); - if (!fdir) + if (!fdir) { + close_safe(&dirfd); return -1; + } while ((de = readdir(fdir))) { if (dir_dots(de))