From aaf527afed109ae647948d466fe76594f48b1e1d Mon Sep 17 00:00:00 2001
From: root <root@localhost.localdomain>
Date: Fri, 22 Mar 2019 19:48:35 +0800
Subject: [PATCH] clear mpp path reference when path is freed, otherwise double
 free may occur in verify_paths.

call stack:
    vecs=vecs@entry=0x557b01d62140, rpvec=rpvec@entry=0x0) at structs_vec.c:521
    at main.c:574
    uev=<optimized out>) at main.c:510
    uev_trigger=uev_trigger@entry=0x557affdfe3d0 <uev_trigger>, trigger_data=<optimized out>)
    at uevent.c:178
---
 libmultipath/discovery.c | 10 ++++++----
 libmultipath/discovery.h |  2 +-
 multipathd/main.c        | 24 +++++++++++++++++++++++-
 3 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/libmultipath/discovery.c b/libmultipath/discovery.c
index 83c8ee6..9e10b41 100644
--- a/libmultipath/discovery.c
+++ b/libmultipath/discovery.c
@@ -124,7 +124,7 @@ transport(int type, int h)
 }
 
 int
-remove_local_path (vector pathvec, struct path *pp)
+remove_local_path (vector pathvec, struct path *pp, int isfree)
 {
 	int i = -1;
 
@@ -139,7 +139,9 @@ remove_local_path (vector pathvec, struct path *pp)
 	if ((i = find_slot(pathvec, (void *)pp)) != -1) {
 		vector_del_slot(pathvec, i);
 	}
-	free_path(pp);
+	if(isfree){
+		free_path(pp);
+	}
 	return 0;
 }
 
@@ -247,7 +249,7 @@ path_discover (vector pathvec, struct config * conf,
 		if (err == 1)
 			return 1;
 		if (err == 0)
-			remove_local_path(pathvec, pp);
+			remove_local_path(pathvec, pp, 1);
 		return 0;
 	}
 	else {
@@ -260,7 +262,7 @@ path_discover (vector pathvec, struct config * conf,
 		if (err)
 			return err;
 		
-		remove_local_path(pathvec, pp);
+		remove_local_path(pathvec, pp, 1);
 		return err;
 	}
 }
diff --git a/libmultipath/discovery.h b/libmultipath/discovery.h
index d8284be..fce5faa 100644
--- a/libmultipath/discovery.h
+++ b/libmultipath/discovery.h
@@ -57,7 +57,7 @@ bool has_uid_fallback(struct path *pp);
 int get_uid(struct path * pp, int path_state, struct udev_device *udev,
 	    int allow_fallback);
 bool is_vpd_page_supported(int fd, int pg);
-int remove_local_path(vector pathvec, struct path *pp);
+int remove_local_path(vector pathvec, struct path *pp, int isfree);
 
 /*
  * discovery bitmask
diff --git a/multipathd/main.c b/multipathd/main.c
index 2b6636d..aa5d1ae 100644
--- a/multipathd/main.c
+++ b/multipathd/main.c
@@ -1015,6 +1015,21 @@ check_path_wwid_change(struct path *pp)
 	return false;
 }
 
+static
+void clear_ref_from_mpp(struct path * pp, struct vectors * vecs)
+{
+	struct multipath * mpp = NULL;
+	int i = -1;
+
+	mpp = find_mp_by_wwid(vecs->mpvec, pp->wwid);
+	if(!!mpp){
+		condlog(2, "%s: clear path from mpp %s", pp->dev, mpp->alias);
+		if ((i = find_slot(mpp->paths, (void *)pp)) != -1){
+			vector_del_slot(mpp->paths, i);
+		}
+	}
+}
+
 /*
  * uev_add_path can call uev_update_path, and uev_update_path can call
  * uev_add_path
@@ -1116,6 +1131,7 @@ uev_add_path (struct uevent *uev, struct vectors * vecs, int need_do_map)
 				i = find_slot(vecs->pathvec, (void *)pp);
 				if (i != -1)
 					vector_del_slot(vecs->pathvec, i);
+				clear_ref_from_mpp(pp, vecs);
 				free_path(pp);
 			} else {
 				condlog(0, "%s: failed to reinitialize path",
@@ -1203,8 +1219,11 @@ ev_add_path (struct path * pp, struct vectors * vecs, int need_do_map)
 	unsigned char prflag = PRFLAG_UNSET;
 
 	/* if pp is local path,remove it and return 0. */
-	if (!remove_local_path(vecs->pathvec, pp))
+	if (!remove_local_path(vecs->pathvec, pp, 0)){
+		clear_ref_from_mpp(pp, vecs);
+		free_path(pp);
 		return 0;
+	}
 
 	/*
 	 * need path UID to go any further
@@ -1219,6 +1238,7 @@ ev_add_path (struct path * pp, struct vectors * vecs, int need_do_map)
 		int i = find_slot(vecs->pathvec, (void *)pp);
 		if (i != -1)
 			vector_del_slot(vecs->pathvec, i);
+		clear_ref_from_mpp(pp, vecs);
 		free_path(pp);
 		return 1;
 	}
@@ -1460,6 +1480,8 @@ ev_remove_path (struct path *pp, struct vectors * vecs, int need_do_map)
 		/* mpp == NULL */
 		if ((i = find_slot(vecs->pathvec, (void *)pp)) != -1)
 			vector_del_slot(vecs->pathvec, i);
+
+		clear_ref_from_mpp(pp, vecs);
 		free_path(pp);
 	}
 out:
-- 
2.33.0