blob: f2791f449f46faea2435391a2b3fa5fa83de815e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
From 531d7991476f8358a36fb7f320db93d38b0e4c8d Mon Sep 17 00:00:00 2001
From: Guoqing Jiang <gqjiang@suse.com>
Date: Thu, 19 Jul 2018 09:40:42 +0800
Subject: [PATCH 39/40] mapfile: set *mapp to NULL after map_free
We can see "double free or corruption" with below steps
as reported by Mariusz:
export IMSM_NO_PLATFORM=1
export IMSM_DEVNAME_AS_SERIAL=1
mdadm --zero-super /dev/sd*
mdadm -C /dev/md/imsm -n2 -eimsm /dev/sdb /dev/sdc --run
mdadm -C /dev/md/r1 -n2 -z15G -eimsm /dev/sdb /dev/sdc -l1 --run --assume-clean
mdadm -f /dev/md126 /dev/sdb
mdadm -Ss
It is caused by Manage_stop calls map_remove and map_unlock,
but *mapp is not set to NULL after map_remove -> map_free,
so map_unlock will call map_free again.
Reported-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com>
Tested-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com>
Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
---
mapfile.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mapfile.c b/mapfile.c
index a5025563..8d7acb3c 100644
--- a/mapfile.c
+++ b/mapfile.c
@@ -268,6 +268,7 @@ void map_remove(struct map_ent **mapp, char *devnm)
map_delete(mapp, devnm);
map_write(*mapp);
map_free(*mapp);
+ *mapp = NULL;
}
struct map_ent *map_by_uuid(struct map_ent **map, int uuid[4])
--
2.17.1
|
