2022-10-20 14:44:04

by Andreas Hasenack

[permalink] [raw]
Subject: Invalid free() in blkmapd, core dump

Hi,

this was brought up before in
https://www.spinics.net/lists/linux-nfs/msg87598.html

We recently got bug reports about the same issue, and it was only
yesterday that I finally managed to reproduce it in a VM.

My reproduction steps are:
- add a scsi device to a vm (not virtio). Maybe works with sata too,
but scsi reproduced it
- add it to an LVM VG, and create an LV
- run blkmapd -f:
# blkmapd -f
blkmapd: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No
such file or directory
double free or corruption (out)
Aborted (core dumped)

The "No such file or directory" has nothing to do with it. You can
"modprobe blocklayoutdriver" to get rid of it, but the invalid free()
still happens.

in 2.6.1, gdb shows:
#9 0x00005555555571e5 in bl_add_disk (filepath=0x7fffffffd480
"/dev/dm-2") at device-discovery.c:232
232 free(serial->data);
(gdb) l
227 disk->dev = dev;
228 disk->size = size;
229 disk->valid_path = path;
230 }
231 if (serial) {
232 free(serial->data);
233 free(serial);
234 }
235 }
236 return;

As lixiaokeng said in that first post, this should be just
free(serial). Or use bl_free_scsi_string(), like his suggested patch
does.


2022-10-20 17:24:26

by Benjamin Coddington

[permalink] [raw]
Subject: Re: Invalid free() in blkmapd, core dump

Adding Steve D directly to see if he can pick up the original fix.

Steve, what happened to https://lore.kernel.org/linux-nfs/[email protected]/ ?

Ben

On 20 Oct 2022, at 10:33, Andreas Hasenack wrote:

> Hi,
>
> this was brought up before in
> https://www.spinics.net/lists/linux-nfs/msg87598.html
>
> We recently got bug reports about the same issue, and it was only
> yesterday that I finally managed to reproduce it in a VM.
>
> My reproduction steps are:
> - add a scsi device to a vm (not virtio). Maybe works with sata too,
> but scsi reproduced it
> - add it to an LVM VG, and create an LV
> - run blkmapd -f:
> # blkmapd -f
> blkmapd: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No
> such file or directory
> double free or corruption (out)
> Aborted (core dumped)
>
> The "No such file or directory" has nothing to do with it. You can
> "modprobe blocklayoutdriver" to get rid of it, but the invalid free()
> still happens.
>
> in 2.6.1, gdb shows:
> #9 0x00005555555571e5 in bl_add_disk (filepath=0x7fffffffd480
> "/dev/dm-2") at device-discovery.c:232
> 232 free(serial->data);
> (gdb) l
> 227 disk->dev = dev;
> 228 disk->size = size;
> 229 disk->valid_path = path;
> 230 }
> 231 if (serial) {
> 232 free(serial->data);
> 233 free(serial);
> 234 }
> 235 }
> 236 return;
>
> As lixiaokeng said in that first post, this should be just
> free(serial). Or use bl_free_scsi_string(), like his suggested patch
> does.

2022-10-24 21:12:17

by Steve Dickson

[permalink] [raw]
Subject: Re: Invalid free() in blkmapd, core dump



On 10/20/22 1:19 PM, Benjamin Coddington wrote:
> Adding Steve D directly to see if he can pick up the original fix.
>
> Steve, what happened to https://lore.kernel.org/linux-nfs/[email protected]/ ?
I just committed it... I have no idea how that fell off my radar...

steved.
>
> Ben
>
> On 20 Oct 2022, at 10:33, Andreas Hasenack wrote:
>
>> Hi,
>>
>> this was brought up before in
>> https://www.spinics.net/lists/linux-nfs/msg87598.html
>>
>> We recently got bug reports about the same issue, and it was only
>> yesterday that I finally managed to reproduce it in a VM.
>>
>> My reproduction steps are:
>> - add a scsi device to a vm (not virtio). Maybe works with sata too,
>> but scsi reproduced it
>> - add it to an LVM VG, and create an LV
>> - run blkmapd -f:
>> # blkmapd -f
>> blkmapd: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No
>> such file or directory
>> double free or corruption (out)
>> Aborted (core dumped)
>>
>> The "No such file or directory" has nothing to do with it. You can
>> "modprobe blocklayoutdriver" to get rid of it, but the invalid free()
>> still happens.
>>
>> in 2.6.1, gdb shows:
>> #9 0x00005555555571e5 in bl_add_disk (filepath=0x7fffffffd480
>> "/dev/dm-2") at device-discovery.c:232
>> 232 free(serial->data);
>> (gdb) l
>> 227 disk->dev = dev;
>> 228 disk->size = size;
>> 229 disk->valid_path = path;
>> 230 }
>> 231 if (serial) {
>> 232 free(serial->data);
>> 233 free(serial);
>> 234 }
>> 235 }
>> 236 return;
>>
>> As lixiaokeng said in that first post, this should be just
>> free(serial). Or use bl_free_scsi_string(), like his suggested patch
>> does.
>