Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <282a3e2f-585b-8f55-fb5b-30bcbdb60155@redhat.com>
Date:   Mon, 24 Oct 2022 14:23:50 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.4.0
Subject: Re: Invalid free() in blkmapd, core dump
Content-Language: en-US
To:     Benjamin Coddington <bcodding@redhat.com>,
        Andreas Hasenack <andreas@canonical.com>
Cc:     linux-nfs@vger.kernel.org
References: <CANYNYEG=utJ2pe+FtMWh8O+dz63R2wbzOC7ZVrvoqD=U04WL5g@mail.gmail.com>
 <12B9F373-E858-4415-B71D-227FD6D7E4D6@redhat.com>
From:   Steve Dickson <steved@redhat.com>
In-Reply-To: <12B9F373-E858-4415-B71D-227FD6D7E4D6@redhat.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 10/20/22 1:19 PM, Benjamin Coddington wrote:
> Adding Steve D directly to see if he can pick up the original fix.
> 
> Steve, what happened to https://lore.kernel.org/linux-nfs/77a09978-a5aa-ea7f-04b8-a8d398ee325f@huawei.com/  ?
I just committed it... I have no idea how that fell off my radar...

steved.
> 
> Ben
> 
> On 20 Oct 2022, at 10:33, Andreas Hasenack wrote:
> 
>> Hi,
>>
>> this was brought up before in
>> https://www.spinics.net/lists/linux-nfs/msg87598.html
>>
>> We recently got bug reports about the same issue, and it was only
>> yesterday that I finally managed to reproduce it in a VM.
>>
>> My reproduction steps are:
>> - add a scsi device to a vm (not virtio). Maybe works with sata too,
>> but scsi reproduced it
>> - add it to an LVM VG, and create an LV
>> - run blkmapd -f:
>> # blkmapd -f
>> blkmapd: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No
>> such file or directory
>> double free or corruption (out)
>> Aborted (core dumped)
>>
>> The "No such file or directory" has nothing to do with it. You can
>> "modprobe blocklayoutdriver" to get rid of it, but the invalid free()
>> still happens.
>>
>> in 2.6.1, gdb shows:
>> #9  0x00005555555571e5 in bl_add_disk (filepath=0x7fffffffd480
>> "/dev/dm-2") at device-discovery.c:232
>> 232 free(serial->data);
>> (gdb) l
>> 227 disk->dev = dev;
>> 228 disk->size = size;
>> 229 disk->valid_path = path;
>> 230 }
>> 231 if (serial) {
>> 232 free(serial->data);
>> 233 free(serial);
>> 234 }
>> 235 }
>> 236 return;
>>
>> As lixiaokeng said in that first post, this should be just
>> free(serial). Or use bl_free_scsi_string(), like his suggested patch
>> does.
>