From: Martin Wilck <mwilck@xxxxxxxx> ... by the paths and pg vectors of the map to be removed. Original bug report from Lixiaokeng ("libmultipath: clear removed path from mpp"): multipathd[3525635]: ==3525635==ERROR: AddressSanitizer: heap-use-after-free on address 0xffffa4902fc0 at pc 0xffffac7d5b88 bp 0xffffa948dac0 sp 0xffffa948dae0 multipathd[3525635]: READ of size 8 at 0xffffa4902fc0 thread T7 multipathd[3525635]: #0 0xffffac7d5b87 in free_multipath (/usr/lib64/libmultipath.so.0+0x4bb87) multipathd[3525635]: #1 0xaaaad6cf7057 (/usr/sbin/multipathd+0x17057) multipathd[3525635]: #2 0xaaaad6cf78eb (/usr/sbin/multipathd+0x178eb) multipathd[3525635]: #3 0xaaaad6cff4df (/usr/sbin/multipathd+0x1f4df) multipathd[3525635]: #4 0xaaaad6cfffe7 (/usr/sbin/multipathd+0x1ffe7) multipathd[3525635]: #5 0xffffac807be3 in uevent_dispatch (/usr/lib64/libmultipath.so.0+0x7dbe3) multipathd[3525635]: #6 0xaaaad6cf563f (/usr/sbin/multipathd+0x1563f) multipathd[3525635]: #7 0xffffac6877af (/usr/lib64/libpthread.so.0+0x87af) multipathd[3525635]: #8 0xffffac44118b (/usr/lib64/libc.so.6+0xd518b) multipathd[3525635]: 0xffffa4902fc0 is located 1344 bytes inside of 1440-byte region [0xffffa4902a80,0xffffa4903020) multipathd[3525635]: freed by thread T7 here: multipathd[3525635]: #0 0xffffac97d703 in free (/usr/lib64/libasan.so.4+0xd0703) multipathd[3525635]: #1 0xffffac824827 in orphan_paths (/usr/lib64/libmultipath.so.0+0x9a827) multipathd[3525635]: #2 0xffffac824a43 in remove_map (/usr/lib64/libmultipath.so.0+0x9aa43) multipathd[3525635]: #3 0xaaaad6cf7057 (/usr/sbin/multipathd+0x17057) multipathd[3525635]: #4 0xaaaad6cf78eb (/usr/sbin/multipathd+0x178eb) multipathd[3525635]: #5 0xaaaad6cff4df (/usr/sbin/multipathd+0x1f4df) multipathd[3525635]: #6 0xaaaad6cfffe7 (/usr/sbin/multipathd+0x1ffe7) multipathd[3525635]: #7 0xffffac807be3 in uevent_dispatch (/usr/lib64/libmultipath.so.0+0x7dbe3) multipathd[3525635]: #8 0xaaaad6cf563f (/usr/sbin/multipathd+0x1563f) multipathd[3525635]: #9 0xffffac6877af (/usr/lib64/libpthread.so.0+0x87af) multipathd[3525635]: #10 0xffffac44118b (/usr/lib64/libc.so.6+0xd518b) When mpp only has one path and log out the path, there is an asan error. In remove_mpp, the pp is freed firstly in orphan_path but is accessed, changed in free_multipath later. Before free_path(pp), the pp should be cleared from pp->mpp. Reported-by: Lixiaokeng <lixiaokeng@xxxxxxxxxx> Tested-by: Lixiaokeng <lixiaokeng@xxxxxxxxxx> Signed-off-by: Martin Wilck <mwilck@xxxxxxxx> --- libmultipath/structs_vec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libmultipath/structs_vec.c b/libmultipath/structs_vec.c index bfec840..61f8e1b 100644 --- a/libmultipath/structs_vec.c +++ b/libmultipath/structs_vec.c @@ -341,6 +341,10 @@ remove_map(struct multipath *mpp, vector pathvec, vector mpvec) { int i; + free_pathvec(mpp->paths, KEEP_PATHS); + free_pgvec(mpp->pg, KEEP_PATHS); + mpp->paths = mpp->pg = NULL; + /* * clear references to this map */ -- 2.33.1 -- dm-devel mailing list dm-devel@xxxxxxxxxx https://listman.redhat.com/mailman/listinfo/dm-devel