diff options
Diffstat (limited to 'debian/patches/0039-mapfile-set-mapp-to-NULL-after-map_free.patch')
| -rw-r--r-- | debian/patches/0039-mapfile-set-mapp-to-NULL-after-map_free.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/debian/patches/0039-mapfile-set-mapp-to-NULL-after-map_free.patch b/debian/patches/0039-mapfile-set-mapp-to-NULL-after-map_free.patch new file mode 100644 index 00000000..f2791f44 --- /dev/null +++ b/debian/patches/0039-mapfile-set-mapp-to-NULL-after-map_free.patch @@ -0,0 +1,43 @@ +From 531d7991476f8358a36fb7f320db93d38b0e4c8d Mon Sep 17 00:00:00 2001 +From: Guoqing Jiang <gqjiang@suse.com> +Date: Thu, 19 Jul 2018 09:40:42 +0800 +Subject: [PATCH 39/40] mapfile: set *mapp to NULL after map_free + +We can see "double free or corruption" with below steps +as reported by Mariusz: + +export IMSM_NO_PLATFORM=1 +export IMSM_DEVNAME_AS_SERIAL=1 +mdadm --zero-super /dev/sd* +mdadm -C /dev/md/imsm -n2 -eimsm /dev/sdb /dev/sdc --run +mdadm -C /dev/md/r1 -n2 -z15G -eimsm /dev/sdb /dev/sdc -l1 --run --assume-clean +mdadm -f /dev/md126 /dev/sdb +mdadm -Ss + +It is caused by Manage_stop calls map_remove and map_unlock, +but *mapp is not set to NULL after map_remove -> map_free, +so map_unlock will call map_free again. + +Reported-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com> +Tested-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com> +Signed-off-by: Guoqing Jiang <gqjiang@suse.com> +Signed-off-by: Jes Sorensen <jsorensen@fb.com> +--- + mapfile.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/mapfile.c b/mapfile.c +index a5025563..8d7acb3c 100644 +--- a/mapfile.c ++++ b/mapfile.c +@@ -268,6 +268,7 @@ void map_remove(struct map_ent **mapp, char *devnm) + map_delete(mapp, devnm); + map_write(*mapp); + map_free(*mapp); ++ *mapp = NULL; + } + + struct map_ent *map_by_uuid(struct map_ent **map, int uuid[4]) +-- +2.17.1 + |