When ev_remove_path() returns success, callers assume that the path (and possibly the map) has been removed. When ev_remove_path() returns failure, callers assume that the path has not been removed. However, the path could be removed on both success or failure. This could cause callers to dereference the path after it was removed. Change ev_remove_path() to return success whenever the path is removed, even if the map was removed due to a failure when trying to reload it. Found by coverity. Signed-off-by: Benjamin Marzinski <bmarzins@xxxxxxxxxx> --- multipathd/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/multipathd/main.c b/multipathd/main.c index 6090434c..4bdf14bd 100644 --- a/multipathd/main.c +++ b/multipathd/main.c @@ -1284,7 +1284,7 @@ ev_remove_path (struct path *pp, struct vectors * vecs, int need_do_map) strlcpy(devt, pp->dev_t, sizeof(devt)); if (setup_multipath(vecs, mpp)) - return 1; + return 0; /* * Successful map reload without this path: * sync_map_state() will free it. @@ -1304,8 +1304,10 @@ out: return retval; fail: + condlog(0, "%s: error removing path. removing map %s", pp->dev, + mpp->alias); remove_map_and_stop_waiter(mpp, vecs); - return 1; + return 0; } static int -- 2.17.2 -- dm-devel mailing list dm-devel@xxxxxxxxxx https://listman.redhat.com/mailman/listinfo/dm-devel
