The path_latency prioriziter was assuming that prepare_directio_read() always succeeds. However, it doesn't, and when it fails, the prioritizer used buf without it pointing to alloced memory. Found by coverity.
Signed-off-by: Benjamin Marzinski <[email protected]> --- libmultipath/prioritizers/path_latency.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libmultipath/prioritizers/path_latency.c b/libmultipath/prioritizers/path_latency.c index 765265c..eeee01e 100644 --- a/libmultipath/prioritizers/path_latency.c +++ b/libmultipath/prioritizers/path_latency.c @@ -237,7 +237,8 @@ int getprio(struct path *pp, char *args, unsigned int timeout) lg_maxavglatency = log(MAX_AVG_LATENCY) / lg_base; lg_minavglatency = log(MIN_AVG_LATENCY) / lg_base; - prepare_directio_read(pp->fd, &blksize, &buf, &restore_flags); + if (prepare_directio_read(pp->fd, &blksize, &buf, &restore_flags) < 0) + return PRIO_UNDEF; temp = io_num; while (temp-- > 0) { -- 2.7.4 -- dm-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/dm-devel
