Martchus
/
mdadm
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

mapfile: set *mapp to NULL after map_free 

We can see "double free or corruption" with below steps
as reported by Mariusz:

export IMSM_NO_PLATFORM=1
export IMSM_DEVNAME_AS_SERIAL=1
mdadm --zero-super /dev/sd*
mdadm -C /dev/md/imsm -n2 -eimsm /dev/sdb /dev/sdc --run
mdadm -C /dev/md/r1 -n2 -z15G -eimsm /dev/sdb /dev/sdc -l1 --run --assume-clean
mdadm -f /dev/md126 /dev/sdb
mdadm -Ss

It is caused by Manage_stop calls map_remove and map_unlock,
but *mapp is not set to NULL after map_remove -> map_free,
so map_unlock will call map_free again.

Reported-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com>
Tested-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com>
Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
This commit is contained in:
Guoqing Jiang 2018-07-19 09:40:42 +08:00 committed by Jes Sorensen
parent cf42a1c707
commit 531d799147
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
mapfile.c
View File

@ -268,6 +268,7 @@ void map_remove(struct map_ent **mapp, char *devnm)
map_delete(mapp, devnm);
map_write(*mapp);
map_free(*mapp);
*mapp = NULL;
}
struct map_ent *map_by_uuid(struct map_ent **map, int uuid[4])