sanlock

#14 double free iobuf,cause sanlock abort
Closed by evanzhang. Opened by evanzhang.

Closed
Reopen Issue

CPU:aarch64 Phytium,S2500
OS :Kylin Linux Advanced Server release Host V10 (Kivity)
glibc-2.28-88.p06.01.ky10.aarch64
sanlock-3.8.1-1.ky10

bt:

0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51

1 0x0000fffec217777c in __GI_abort () at abort.c:79

2 0x0000fffec21b07d0 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0xfffec2270658 "%s\n")

at ../sysdeps/posix/libc_fatal.c:181

3 0x0000fffec21b6f3c in malloc_printerr (

str=str@entry=0xfffec226e028 "corrupted size vs. prev_size while consolidating") at malloc.c:5390

4 0x0000fffec21b8c8c in _int_free (av=0xfffe88000020, p=0xfffe880a0440, have_lock=)

at malloc.c:4332

5 0x0000aaae031dc6d0 in do_linux_aio (fd=, offset=69206016,

buf=0xfffebac90000 "\020 \025\006\004", len=1048576, task=0xfffe92fde900, ioto=10, cmd=cmd@entry=0,
ms=ms@entry=0x0) at diskio.c:707

6 0x0000aaae031dd5fc in do_read_aio_linux (rd_ms=0x0, ioto=, task=,

len=<optimized out>, buf=<optimized out>, offset=<optimized out>, fd=<optimized out>) at diskio.c:794

7 read_iobuf (fd=62, offset=69206016, iobuf=iobuf@entry=0xfffebac90000 "\020 \025\006\004",

iobuf_len=iobuf_len@entry=1048576, task=task@entry=0xfffe92fde900, ioto=<optimized out>,
rd_ms=rd_ms@entry=0x0) at diskio.c:902

8 0x0000aaae031e839c in _lease_read_one (task=0xfffe92fde900, task@entry=0x0,

token=token@entry=0xfffe88020450, flags=52560605, flags@entry=0, disk=0xfffe88020640,
leader_ret=0xfffe92fdd8a0, leader_ret@entry=0x0, our_dblock=0xfffe92fdd6f0,
our_dblock@entry=0xfffe92fdd830, max_mbal=0xaaae03220141 <log_str+97>, max_mbal@entry=0x0,
max_q=0xaaae0322010e <log_str+46>, max_q@entry=0x0, log_bk_vals=log_bk_vals@entry=1,
caller=0xaaae031fef58 "paxos_acquire") at paxos_lease.c:1364

9 0x0000aaae031e9538 in paxos_lease_read (caller=0xaaae031fef58 "paxos_acquire", log_bk_vals=1,

max_mbal=0x0, leader_ret=0x0, flags=0, token=0xfffe88020450, task=0x0) at paxos_lease.c:1560

10 paxos_lease_acquire (task=task@entry=0x0, token=token@entry=0xfffe88020450, flags=0, leader_ret=0x0,

leader_ret@entry=0xfffe92fde310, dblock_ret=dblock_ret@entry=0x0, acquire_lver=acquire_lver@entry=0,
new_num_hosts=new_num_hosts@entry=0) at paxos_lease.c:1692

11 0x0000aaae031eef34 in acquire_disk (dblock=0x0, leader=0xfffe92fde248, owner_nowait=0,

new_num_hosts=<optimized out>, acquire_lver=0, token=0xfffe88020450, task=0x0) at resource.c:798

12 acquire_token (task=task@entry=0x0, token=token@entry=0xfffe88020450, cmd_flags=0,

killpath=killpath@entry=0x0,
killargs=killargs@entry=0x646b636f6c6d766c <error: Cannot access memory at address 0x646b636f6c6d766c>)
at resource.c:1821

13 0x0000aaae031f3684 in cmd_acquire (task=0x0, task@entry=0xfffe92fde900, ca=ca@entry=0xaaae115bb580,

cmd=0, cmd@entry=7) at cmd.c:386

14 0x0000aaae031f6ac8 in call_cmd_thread (task=0xfffe92fde900, ca=0xaaae115bb580) at cmd.c:2144

sanlock log:
2024-12-20 21:37:32 24216827 [17063]: worker5 aio timeout RD 0xfffe88000b20:0xfffe88000b30:0xfffe880b0000 ioto 10 to_count 5
2024-12-20 21:37:32 24216827 [17063]: s7:r8 acquire_token read_lvb error -202
2024-12-20 21:37:32 24216827 [23579]: s10 delta_renew long write time 11 sec
2024-12-20 21:37:33 24216829 [17063]: worker5 aio collect RD 0xfffe88000b20:0xfffe88000b30:0xfffe880b0000 result 512:0 other free

The same tracestack appears 3 times

Signed-off-by: Evanzhang Evanzhang@archeros.com

src/delta_lease.c | 6 ++++--
src/diskio.c | 12 ++++++++----
src/paxos_lease.c | 19 ++++++++++++-------
src/resource.c | 14 +++++++++-----
src/rindex.c | 19 ++++++++++++-------
5 files changed, 45 insertions(+), 25 deletions(-)

diff --git a/src/delta_lease.c b/src/delta_lease.c index 144c0ea..0d6da56 100644
--- a/src/delta_lease.c
+++ b/src/delta_lease.c
@@ -1010,8 +1010,10 @@ int delta_lease_init(struct task *task,

rv = write_iobuf(disk->fd, disk->offset, iobuf, sector_size, task, write_io_timeout, NULL);

out:
- if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }

return rv;

}
diff --git a/src/diskio.c b/src/diskio.c index 1d84a6c..609be00 100644
--- a/src/diskio.c
+++ b/src/diskio.c
@@ -855,8 +855,10 @@ static int write_sectors(const struct sync_disk *disk, int sector_size, uint64
blktype, (unsigned long long)offset, rv, disk->path);
}

-if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }
out:
return rv;
}
@@ -967,8 +969,10 @@ int read_sectors(const struct sync_disk *disk, int sector_size, uint64_t sector_
blktype, (unsigned long long)offset, rv, disk->path);
}

-if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }
out:
return rv;
}
diff --git a/src/paxos_lease.c b/src/paxos_lease.c index 8f7d816..5348c6b 100644
--- a/src/paxos_lease.c
+++ b/src/paxos_lease.c
@@ -240,8 +240,10 @@ static int write_dblock_mblock_sh(struct task *task,
rv);
}

-if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }
return rv;
}

@@ -1598,8 +1600,10 @@ static int _lease_read_one(struct task task,
task->paxos_hugebuf_size = 0;
}
} else {
- if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }
/ else iobuf will be freed when aio completes /
}
return rv;
@@ -2747,9 +2751,10 @@ int paxos_lease_init(struct task task,
}
}

-if (!aio_timeout)
- free(iobuf);
+ if (!aio_timeout) {
+ free(iobuf);
+ iobuf = NULL;
+ }
return 0;
}

diff --git a/src/resource.c b/src/resource.c index 6cbfbf0..65a0c8d 100644
--- a/src/resource.c
+++ b/src/resource.c
@@ -659,9 +659,11 @@ static int write_host_block(struct task task, struct token token,
(unsigned long long)host_id, mb_flags, (unsigned long long)mb_gen);
}

-if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
-return rv;
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }
+ return rv;
}

static int write_mblock_zero_dblock_release(struct task task, struct token token) @@ -729,8 +731,10 @@ static int read_mode_block(struct task task, struct token token,
break;
}

-if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }

return rv;

}
diff --git a/src/rindex.c b/src/rindex.c index a4196d2..42870f9 100644
--- a/src/rindex.c
+++ b/src/rindex.c
@@ -238,9 +238,10 @@ static int update_rindex(struct task *task,

rv = write_iobuf(rx->disk->fd, rx->disk->offset + sector_offset, sector_iobuf, iobuf_len, task, spi->io_timeout, NULL);

-if (rv != SANLK_AIO_TIMEOUT)
- free(sector_iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(sector_iobuf);
+ sector_iobuf = NULL;
+ }
return rv;
}

@@ -359,8 +360,10 @@ static int read_rindex_header(struct task *task,
goto out;
}
out:
- if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }

return rv;

}
@@ -475,8 +478,10 @@ int rindex_format(struct task task, struct sanlk_rindex ri)
out_token:
free(token);
out_iobuf:
- if (rv != SANLK_AIO_TIMEOUT)
- free(iobuf);
+ if (rv != SANLK_AIO_TIMEOUT) {
+ free(iobuf);
+ iobuf = NULL;
+ }
out_close:
close_disks(rx.disk, 1);
return rv;
Edited by evanzhang

Please check if this commit fixes the problem:
https://pagure.io/sanlock/c/b2619f005d55e8f6377345f5ca52c84c37a718d4?branch=master

Metadata Update from @evanzhang:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.