From 531d7991476f8358a36fb7f320db93d38b0e4c8d Mon Sep 17 00:00:00 2001 From: Guoqing Jiang Date: Thu, 19 Jul 2018 09:40:42 +0800 Subject: [PATCH] mapfile: set *mapp to NULL after map_free We can see "double free or corruption" with below steps as reported by Mariusz: export IMSM_NO_PLATFORM=1 export IMSM_DEVNAME_AS_SERIAL=1 mdadm --zero-super /dev/sd* mdadm -C /dev/md/imsm -n2 -eimsm /dev/sdb /dev/sdc --run mdadm -C /dev/md/r1 -n2 -z15G -eimsm /dev/sdb /dev/sdc -l1 --run --assume-clean mdadm -f /dev/md126 /dev/sdb mdadm -Ss It is caused by Manage_stop calls map_remove and map_unlock, but *mapp is not set to NULL after map_remove -> map_free, so map_unlock will call map_free again. Reported-by: Tkaczyk Mariusz Tested-by: Tkaczyk Mariusz Signed-off-by: Guoqing Jiang Signed-off-by: Jes Sorensen --- mapfile.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mapfile.c b/mapfile.c index a5025563..8d7acb3c 100644 --- a/mapfile.c +++ b/mapfile.c @@ -268,6 +268,7 @@ void map_remove(struct map_ent **mapp, char *devnm) map_delete(mapp, devnm); map_write(*mapp); map_free(*mapp); + *mapp = NULL; } struct map_ent *map_by_uuid(struct map_ent **map, int uuid[4]) -- 2.39.2