Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Benjamin Coddington <bcodding@redhat.com>
To:     Andreas Hasenack <andreas@canonical.com>,
        Steve Dickson <steved@redhat.com>
Cc:     linux-nfs@vger.kernel.org
Subject: Re: Invalid free() in blkmapd, core dump
Date:   Thu, 20 Oct 2022 13:19:00 -0400
Message-ID: <12B9F373-E858-4415-B71D-227FD6D7E4D6@redhat.com>
In-Reply-To: <CANYNYEG=utJ2pe+FtMWh8O+dz63R2wbzOC7ZVrvoqD=U04WL5g@mail.gmail.com>
References: <CANYNYEG=utJ2pe+FtMWh8O+dz63R2wbzOC7ZVrvoqD=U04WL5g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Adding Steve D directly to see if he can pick up the original fix.

Steve, what happened to https://lore.kernel.org/linux-nfs/77a09978-a5aa-e=
a7f-04b8-a8d398ee325f@huawei.com/  ?

Ben

On 20 Oct 2022, at 10:33, Andreas Hasenack wrote:

> Hi,
>
> this was brought up before in
> https://www.spinics.net/lists/linux-nfs/msg87598.html
>
> We recently got bug reports about the same issue, and it was only
> yesterday that I finally managed to reproduce it in a VM.
>
> My reproduction steps are:
> - add a scsi device to a vm (not virtio). Maybe works with sata too,
> but scsi reproduced it
> - add it to an LVM VG, and create an LV
> - run blkmapd -f:
> # blkmapd -f
> blkmapd: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No
> such file or directory
> double free or corruption (out)
> Aborted (core dumped)
>
> The "No such file or directory" has nothing to do with it. You can
> "modprobe blocklayoutdriver" to get rid of it, but the invalid free()
> still happens.
>
> in 2.6.1, gdb shows:
> #9  0x00005555555571e5 in bl_add_disk (filepath=3D0x7fffffffd480
> "/dev/dm-2") at device-discovery.c:232
> 232 free(serial->data);
> (gdb) l
> 227 disk->dev =3D dev;
> 228 disk->size =3D size;
> 229 disk->valid_path =3D path;
> 230 }
> 231 if (serial) {
> 232 free(serial->data);
> 233 free(serial);
> 234 }
> 235 }
> 236 return;
>
> As lixiaokeng said in that first post, this should be just
> free(serial). Or use bl_free_scsi_string(), like his suggested patch
> does.