| Message ID | 1620926595-12029-4-git-send-email-bmarzins@redhat.com (mailing list archive) |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | christophe varoqui |
| Headers | show |
| Series | Memory issues found by coverity | expand |
On Thu, 2021-05-13 at 12:23 -0500, Benjamin Marzinski wrote: > When ev_remove_path() returns success, callers assume that the path > (and > possibly the map) has been removed. When ev_remove_path() returns > failure, callers assume that the path has not been removed. However, > the > path could be removed on both success or failure. This could cause > callers to dereference the path after it was removed. Change > ev_remove_path() to return success whenever the path is removed, even > if > the map was removed due to a failure when trying to reload it. Found > by > coverity. > > Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> I'd have preferred to to join this with patch no. 6. Anyway: Reviewed-by: Martin Wilck <mwilck@suse.com> -- dm-devel mailing list dm-devel@redhat.com https://listman.redhat.com/mailman/listinfo/dm-devel
diff --git a/multipathd/main.c b/multipathd/main.c index 6090434c..4bdf14bd 100644 --- a/multipathd/main.c +++ b/multipathd/main.c @@ -1284,7 +1284,7 @@ ev_remove_path (struct path *pp, struct vectors * vecs, int need_do_map) strlcpy(devt, pp->dev_t, sizeof(devt)); if (setup_multipath(vecs, mpp)) - return 1; + return 0; /* * Successful map reload without this path: * sync_map_state() will free it. @@ -1304,8 +1304,10 @@ out: return retval; fail: + condlog(0, "%s: error removing path. removing map %s", pp->dev, + mpp->alias); remove_map_and_stop_waiter(mpp, vecs); - return 1; + return 0; } static int
When ev_remove_path() returns success, callers assume that the path (and possibly the map) has been removed. When ev_remove_path() returns failure, callers assume that the path has not been removed. However, the path could be removed on both success or failure. This could cause callers to dereference the path after it was removed. Change ev_remove_path() to return success whenever the path is removed, even if the map was removed due to a failure when trying to reload it. Found by coverity. Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> --- multipathd/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)