From patchwork Tue Apr 28 21:54:12 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: christophe varoqui X-Patchwork-Id: 20531 X-Patchwork-Delegate: christophe.varoqui@free.fr Received: from hormel.redhat.com (hormel1.redhat.com [209.132.177.33]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n3SLsYcN024662 for ; Tue, 28 Apr 2009 21:54:34 GMT Received: from listman.util.phx.redhat.com (listman.util.phx.redhat.com [10.8.4.110]) by hormel.redhat.com (Postfix) with ESMTP id C49C561A49D; Tue, 28 Apr 2009 17:54:32 -0400 (EDT) Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254]) by listman.util.phx.redhat.com (8.13.1/8.13.1) with ESMTP id n3SLsUvh028327 for ; Tue, 28 Apr 2009 17:54:31 -0400 Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n3SLsUR5031571 for ; Tue, 28 Apr 2009 17:54:30 -0400 Received: from wmproxy2-g27.free.fr (wmproxy2-g27.free.fr [212.27.42.92]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n3SLsF1W009654 for ; Tue, 28 Apr 2009 17:54:16 -0400 Received: from wmproxy2-g27.free.fr (localhost [127.0.0.1]) by wmproxy2-g27.free.fr (Postfix) with ESMTP id 50AD2F2B7; Tue, 28 Apr 2009 23:54:13 +0200 (CEST) Received: from zimbra16-e3.priv.proxad.net (zimbra16-e3.priv.proxad.net [172.20.243.166]) by wmproxy2-g27.free.fr (Postfix) with ESMTP id A8C5EF2AD; Tue, 28 Apr 2009 23:54:06 +0200 (CEST) Date: Tue, 28 Apr 2009 23:54:12 +0200 (CEST) From: christophe.varoqui@free.fr To: device-mapper development Message-ID: <1070283948.4550841240955652169.JavaMail.root@zimbra16-e3.priv.proxad.net> In-Reply-To: <20090423011834.GA14759@redhat.com> Subject: Re: [dm-devel] [PATCH] fix double frees in recent multipath-tools MIME-Version: 1.0 X-Originating-IP: [82.233.48.227] X-Authenticated-User: christophe.varoqui@free.fr X-RedHat-Spam-Score: 0.074 X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254 X-Scanned-By: MIMEDefang 2.63 on 172.16.48.31 X-MIME-Autoconverted: from quoted-printable to 8bit by listman.util.phx.redhat.com id n3SLsUvh028327 X-loop: dm-devel@redhat.com Cc: X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.5 Precedence: junk Reply-To: device-mapper development List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com Merged as ef341c2fa151b1c5b8ba26633fc28916161a85ff ... with due credit. ----- Mail Original ----- De: "Mike Snitzer" À: "Hannes Reinecke" Cc: dm-devel@redhat.com Envoyé: Jeudi 23 Avril 2009 03h18:35 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: [dm-devel] [PATCH] fix double frees in recent multipath-tools On Wed, Apr 22 2009 at 6:05pm -0400, Mike Snitzer wrote: > > Seems the latest multipath-tools has an issue with a double free. I > haven't looked at what the proper fix is yet but I wanted to give others > a heads up. > > Running something as basic as 'multipath' drops a core. ... > (gdb) bt > #0 0x0000003a6ec32f05 in raise () from /lib64/libc.so.6 > #1 0x0000003a6ec34a73 in abort () from /lib64/libc.so.6 > #2 0x0000003a6ec72438 in __libc_message () from /lib64/libc.so.6 > #3 0x0000003a6ec77ec8 in malloc_printerr () from /lib64/libc.so.6 > #4 0x0000003a6ec7a486 in free () from /lib64/libc.so.6 > #5 0x00007ffff7dbc205 in xfree (p=0x60b2e0) at memory.c:52 > #6 0x00007ffff7dc3624 in free_config (conf=0x604620) at config.c:414 > #7 0x00000000004027a4 in main (argc=3, argv=0x7fffffffe718) at main.c:474 > (gdb) frame 6 > #6 0x00007ffff7dc3624 in free_config (conf=0x604620) at config.c:414 > (gdb) l > 409 > 410 if (conf->checker_name) > 411 FREE(conf->checker_name); > 412 > 413 if (conf->prio_name) > 414 FREE(conf->prio_name); > 415 > 416 if (conf->checker_name) > 417 FREE(conf->checker_name); > 418 Here is another one: (gdb) bt #0 0x0000003a6ec32f05 in raise () from /lib64/libc.so.6 #1 0x0000003a6ec34a73 in abort () from /lib64/libc.so.6 #2 0x0000003a6ec72438 in __libc_message () from /lib64/libc.so.6 #3 0x0000003a6ec77ec8 in malloc_printerr () from /lib64/libc.so.6 #4 0x0000003a6ec7a486 in free () from /lib64/libc.so.6 #5 0x00007ffff7dbc205 in xfree (p=0x604a90) at memory.c:52 #6 0x00007ffff7dc2ac2 in free_hwe (hwe=0x604950) at config.c:162 #7 0x00007ffff7dc2b0f in free_hwtable (hwtable=0x604460) at config.c:179 #8 0x00007ffff7dc3684 in free_config (conf=0x604620) at config.c:422 #9 0x00000000004027a4 in main (argc=1, argv=0x7fffffffe738) at main.c:474 (gdb) frame 6 #6 0x00007ffff7dc2ac2 in free_hwe (hwe=0x604950) at config.c:162 162 FREE(hwe->prio_name); (gdb) l 157 158 if (hwe->bl_product) 159 FREE(hwe->bl_product); 160 161 if (hwe->prio_name) 162 FREE(hwe->prio_name); 163 164 if (hwe->checker_name) 165 FREE(hwe->checker_name); 166 FREE(hwe); The following patch fixes the crashes I saw. --- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel -- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel diff --git a/libmultipath/config.c b/libmultipath/config.c index 6039642..05dbcd2 100644 --- a/libmultipath/config.c +++ b/libmultipath/config.c @@ -158,11 +158,6 @@ free_hwe (struct hwentry * hwe) if (hwe->bl_product) FREE(hwe->bl_product); - if (hwe->prio_name) - FREE(hwe->prio_name); - - if (hwe->checker_name) - FREE(hwe->checker_name); FREE(hwe); } @@ -410,12 +405,6 @@ free_config (struct config * conf) if (conf->checker_name) FREE(conf->checker_name); - if (conf->prio_name) - FREE(conf->prio_name); - - if (conf->checker_name) - FREE(conf->checker_name); - free_blacklist(conf->blist_devnode); free_blacklist(conf->blist_wwid); free_blacklist_device(conf->blist_device);