Bug 237368 - /bin/df ; df on more than one unmounted device coredumps
Summary: /bin/df ; df on more than one unmounted device coredumps
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-bugs mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-18 20:42 UTC by Jamie Landeg-Jones
Modified: 2019-06-24 16:16 UTC (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jamie Landeg-Jones 2019-04-18 20:42:15 UTC
I realise "df on unmountd devices is deprecated", but even so, as it stands, there appears to be an invalid free, which causes coredump.

/usr/src/bin/df/df.c:

Line 276 and 277:

if (iov != NULL)
     free_iovec(&iov, &iovlen);

This is called prior to building the mount structure for nmount. If the structure has been used before, it tries to free it, but causes a coredump in the process.

To reproduce, run df on 2 or more unmounted devices (you don't actually need a real unmounted device to trigger the bug, simply doing "df /dev/*" will trigger the above codepath.

[ I tagged this "current" because it still occurs in current, but it's in 12-stable too ]

cheers, Jamie
Comment 1 WHR 2019-06-21 09:08:34 UTC
Seems also affecting 11.2-RELEASE.
Comment 2 Jamie Landeg-Jones 2019-06-21 14:15:48 UTC
Cheers, WHR.

Anyone listening?

I'll provide a patch to fix or remove this depracted code if required.
Comment 3 Jamie Landeg-Jones 2019-06-22 17:55:27 UTC
See also:  https://reviews.freebsd.org/D8801
Comment 4 Conrad Meyer freebsd_committer 2019-06-22 18:07:52 UTC
IMO, removing it is a reasonable fix for CURRENT, and maybe 12 (I don't touch stable myself, though).  I can do it for CURRENT if I get an ack from a committer (e.g., Brooks), or Brooks can go ahead and do it (feel free to 'Discussed with: me' the commit).
Comment 5 WHR 2019-06-24 03:26:40 UTC
I agree removing this feature.
Comment 6 Jamie Landeg-Jones 2019-06-24 16:16:29 UTC
WHR, the quick fix would be:

17:15 (8) "src" jamie@thompson% diff -u bin//df/Makefile.orig bin/df/Makefile
--- bin//df/Makefile.orig       2017-03-04 11:31:08.753360000 +0000
+++ bin/df/Makefile     2019-04-18 21:54:54.741564000 +0100
@@ -10,7 +10,7 @@

 CFLAGS+= -I${MOUNT}

-CFLAGS+= -DMOUNT_CHAR_DEVS
+# CFLAGS+= -DMOUNT_CHAR_DEVS
 SRCS+= getmntopts.c

 LIBADD=        xo util