Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
From:   Andreas Hasenack <andreas@canonical.com>
Date:   Thu, 20 Oct 2022 11:33:42 -0300
Message-ID: <CANYNYEG=utJ2pe+FtMWh8O+dz63R2wbzOC7ZVrvoqD=U04WL5g@mail.gmail.com>
Subject: Invalid free() in blkmapd, core dump
To:     linux-nfs@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi,

this was brought up before in
https://www.spinics.net/lists/linux-nfs/msg87598.html

We recently got bug reports about the same issue, and it was only
yesterday that I finally managed to reproduce it in a VM.

My reproduction steps are:
- add a scsi device to a vm (not virtio). Maybe works with sata too,
but scsi reproduced it
- add it to an LVM VG, and create an LV
- run blkmapd -f:
# blkmapd -f
blkmapd: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No
such file or directory
double free or corruption (out)
Aborted (core dumped)

The "No such file or directory" has nothing to do with it. You can
"modprobe blocklayoutdriver" to get rid of it, but the invalid free()
still happens.

in 2.6.1, gdb shows:
#9  0x00005555555571e5 in bl_add_disk (filepath=0x7fffffffd480
"/dev/dm-2") at device-discovery.c:232
232 free(serial->data);
(gdb) l
227 disk->dev = dev;
228 disk->size = size;
229 disk->valid_path = path;
230 }
231 if (serial) {
232 free(serial->data);
233 free(serial);
234 }
235 }
236 return;

As lixiaokeng said in that first post, this should be just
free(serial). Or use bl_free_scsi_string(), like his suggested patch
does.