[Bug 713237] Re: shutdown segv due to race w/ free_waiter threads

[Serge Hallyn]

** Description changed:

  Binary package hint: multipath-tools
+ 
+ ==========================================
+ SRU Justification:
+ 1. Impact: segv on multipathd shutdown
+ 2. How bug was addressed: a patch was cherrypicked from upstream which fixes this
+ 3. Minimal patch: see patch in attached bzr tree
+ 4. TEST CASE: stop multipathd.
+ 5. Regression potential: none, this patch was taken from upstream.
+ ==========================================
  
  I received a coredump from a customer (running a lucid-based system).
  Analyzing the core from multipathd shows that we are crashing in waiter.c::free_waiter().
  
  void free_waiter (void *data)
  {
-  struct event_thread *wp = (struct event_thread *)data;
+  struct event_thread *wp = (struct event_thread *)data;
  
-  /*
-   * indicate in mpp that the wp is already freed storage
-   */
-  lock(wp->vecs->lock);
+  /*
+   * indicate in mpp that the wp is already freed storage
+   */
+  lock(wp->vecs->lock);
  
-  if (wp->mpp)
-   /*
-    * be careful, mpp may already be freed -- null if so
-    */
-   wp->mpp->waiter = NULL;
-  else
-   condlog(3, "free_waiter, mpp freed before wp=%p,", wp);
+  if (wp->mpp)
+   /*
+    * be careful, mpp may already be freed -- null if so
+    */
+   wp->mpp->waiter = NULL;
+  else
+   condlog(3, "free_waiter, mpp freed before wp=%p,", wp);
  
-  unlock(wp->vecs->lock); <<< Crashing here
+  unlock(wp->vecs->lock); <<< Crashing here
  
-  if (wp->dmt)
-   dm_task_destroy(wp->dmt);
+  if (wp->dmt)
+   dm_task_destroy(wp->dmt);
  
-  FREE(wp);
+  FREE(wp);
  }
  
  The lock is NULL:
  
  (gdb) print wp->vecs->lock
  $3 = (pthread_mutex_t *) 0x0
  
  This appears to be the upstream issue fixed here:
  http://git.kernel.org/gitweb.cgi?p=linux/storage/multipath-tools/.git;a=commitdiff;h=a403f57b991f3be7c7ea6250d95fad1554c9d6ca
  
  This fix is currently missing from all versions of multipath-tools in
  lucid->natty.
  
  (The original customer issue was filed in the private bug #712875.)

** Also affects: multipath-tools (Ubuntu Lucid)
   Importance: Undecided
       Status: New

** Also affects: multipath-tools (Ubuntu Maverick)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to multipath-tools in Ubuntu.
https://bugs.launchpad.net/bugs/713237

Title:
  shutdown segv due to race w/ free_waiter threads