commit 633d825ccf450073e4489ee8ab66a44303b1a0d7
author Jens Axboe <axboe@fb.com> Wed Jul 02 13:36:34 2014 -0600
committer Mohamad Ayyash <mkayyash@google.com> Fri Mar 06 17:57:10 2015 -0800
tree 7afc54b37464f7fb3258b32c91bb6e9535c34f7a
parent 01f1d15ad8eb284237ba41ab99f27ba8e3552b3c

log: fix use-after-free

Introduced in commit cb7e0ace739c.

Signed-off-by: Jens Axboe <axboe@fb.com>

backend.c

diff --git a/backend.c b/backend.c
index 95a7572..448fc59 100644
--- a/backend.c
+++ b/backend.c
@@ -2047,6 +2047,7 @@
 				struct io_log *log = agg_io_log[i];
 
 				__finish_log(log);
+				free_log(log);
 			}
 		}
 	}

iolog.c

diff --git a/iolog.c b/iolog.c
index a8bead1..96afec6 100644
--- a/iolog.c
+++ b/iolog.c
@@ -581,7 +581,7 @@
 }
 #endif
 
-static void free_log(struct io_log *log)
+void free_log(struct io_log *log)
 {
 	free(log->log);
 	free(log->filename);
@@ -623,7 +623,6 @@
 
 	fclose(f);
 	clear_file_buffer(buf);
-	free_log(log);
 }
 
 static int finish_log(struct thread_data *td, struct io_log *log, int trylock)
@@ -636,11 +635,11 @@
 
 	if (td->client_type == FIO_CLIENT_TYPE_GUI) {
 		fio_send_iolog(td, log, log->filename);
-		free_log(log);
 	} else
 		__finish_log(log);
 
 	fio_unlock_file(log->filename);
+	free_log(log);
 	return 0;
 }
 

iolog.h

diff --git a/iolog.h b/iolog.h
index 2c9b2b2..f97d91f 100644
--- a/iolog.h
+++ b/iolog.h
@@ -171,6 +171,7 @@
 extern void update_rusage_stat(struct thread_data *);
 extern void setup_log(struct io_log **, unsigned long, int, int, const char *);
 extern void __finish_log(struct io_log *);
+extern void free_log(struct io_log *);
 extern struct io_log *agg_io_log[DDIR_RWDIR_CNT];
 extern int write_bw_log;
 extern void add_agg_sample(unsigned long, enum fio_ddir, unsigned int);