diff --git a/0027-clean-up-group-struct-in-_stats_create_group-error-path.patch b/0027-clean-up-group-struct-in-_stats_create_group-error-path.patch new file mode 100644 index 0000000000000000000000000000000000000000..010172fbc8e58747bd5a9fdb4b95af518a945879 --- /dev/null +++ b/0027-clean-up-group-struct-in-_stats_create_group-error-path.patch @@ -0,0 +1,43 @@ +From eda99fc3839dcd439270ba5977ca6628bd9752cc Mon Sep 17 00:00:00 2001 +From: "Bryn M. Reeves" +Date: Thu, 31 Aug 2023 16:59:02 +0100 +Subject: [PATCH] Clean up group struct in _stats_create_group() error path + +Conflict: NA +Reference: https://sourceware.org/git/?p=lvm2.git;a=commitdiff;h=eda99fc3839dcd439270ba5977ca6628bd9752cc + +Fix a double free in the error path from _stats_create_group() by +clearing the group struct embedded in the dm_stats handle before +returning: + + device-mapper: message ioctl on (253:0) failed: Invalid argument + Could not create regions from file /var/tmp/File With Spaces. + free(): double free detected in tcache 2 + Aborted (core dumped) +--- + libdm/libdm-stats.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/libdm/libdm-stats.c b/libdm/libdm-stats.c +index 62b28b69d..dc2907f4e 100644 +--- a/libdm/libdm-stats.c ++++ b/libdm/libdm-stats.c +@@ -3908,9 +3908,14 @@ static int _stats_create_group(struct dm_stats *dms, dm_bitset_t regions, + + /* force an update of the group tag stored in aux_data */ + if (!_stats_set_aux(dms, *group_id, dms->regions[*group_id].aux_data)) +- return 0; ++ goto bad; + + return 1; ++bad: ++ group->group_id = DM_STATS_GROUP_NOT_PRESENT; ++ group->regions = NULL; ++ dm_free((char *) group->alias); ++ return 0; + } + + static int _stats_group_check_overlap(const struct dm_stats *dms, +-- +2.39.3 + diff --git a/lvm2.spec b/lvm2.spec index a311a977108135cd2d9f0641843dcf72e3bf6136..734ceed216a3ead398eb93f54f0c1a636fb264ac 100644 --- a/lvm2.spec +++ b/lvm2.spec @@ -43,7 +43,7 @@ Name: lvm2 Version: 2.03.09 -Release: 16 +Release: 17 Epoch: 8 Summary: Tools for logical volume management License: GPLv2+ and LGPLv2.1 and BSD @@ -75,6 +75,7 @@ Patch23: 0023-udev-create-symlinks-and-watch-even-in-suspended-sta.patch Patch24: 0024-udev-import-previous-results-of-blkid-when-in-suspen.patch patch25: 0025-toollib-fix-segfault-if-using-S-select-with-log-repo.patch Patch26: 0026-dm-event-release-buffer-on-dm_event_get_version.patch +patch27: 0027-clean-up-group-struct-in-_stats_create_group-error-path.patch BuildRequires: gcc BuildRequires: gcc-c++ @@ -500,6 +501,9 @@ fi %changelog +* Tue Dec 19 2023 wuyifeng - 8:2.03.09-17 +- fix an double free in the error path from _stats_creat_group + * Tue Dec 19 2023 wangzhiqiang - 8:2.03.09-16 - dm-event: release buffer on dm_event_get_version