Description of problem: amtapetype attempts an invalid free # mt -f /dev/st0 status SCSI 2 tape drive: File number=0, block number=0, partition=0. Tape block size 0 bytes. Density code 0x41 (DLT 40GB, or Ultrium2). Soft error count since last status=0 General status bits on (41010000): BOT ONLINE IM_REP_EN # mt -f /dev/st0 rewind # mt -f /dev/nst0 compression 0 # mt -f /dev/nst0 setblk 0 # valgrind --leak-check=yes amtapetype -o -t DLT8000 -e 40g -f /dev/nst0 ==13968== Memcheck, a memory error detector. ==13968== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al. ==13968== Using LibVEX rev 1658, a library for dynamic binary translation. ==13968== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP. ==13968== Using valgrind-3.2.1, a dynamic binary instrumentation framework. ==13968== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al. ==13968== For more details, rerun with: -v ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x4844543: tapefd_rewind (tapeio.c:632) ==13968== by 0x4844C3D: tapefd_rdlabel (tapeio.c:843) ==13968== by 0x16E7: main (tapetype.c:402) ==13968== Address 0xBEBC5676 is on thread 1's stack ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x4844543: tapefd_rewind (tapeio.c:632) ==13968== by 0x171C: main (tapetype.c:409) ==13968== Address 0xBEBC6806 is on thread 1's stack Estimate phase 1...==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x4844543: tapefd_rewind (tapeio.c:632) ==13968== by 0xFFE: do_pass0 (tapetype.c:254) ==13968== by 0x186D: main (tapetype.c:472) ==13968== Address 0xBEBC67C6 is on thread 1's stack ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x48443AA: tapefd_weof (tapeio.c:694) ==13968== by 0x103B: do_pass0 (tapetype.c:263) ==13968== by 0x186D: main (tapetype.c:472) ==13968== Address 0xBEBC67BE is on thread 1's stack ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x48443AA: tapefd_weof (tapeio.c:694) ==13968== by 0x103B: do_pass0 (tapetype.c:263) ==13968== by 0x1884: main (tapetype.c:473) ==13968== Address 0xBEBC67BE is on thread 1's stack Writing 256 Mbyte compresseable data: 45 sec Estimate phase 2...==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x4844543: tapefd_rewind (tapeio.c:632) ==13968== by 0xFFE: do_pass0 (tapetype.c:254) ==13968== by 0x197C: main (tapetype.c:491) ==13968== Address 0xBEBC67C6 is on thread 1's stack ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x48443AA: tapefd_weof (tapeio.c:694) ==13968== by 0x103B: do_pass0 (tapetype.c:263) ==13968== by 0x197C: main (tapetype.c:491) ==13968== Address 0xBEBC67BE is on thread 1's stack ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x48443AA: tapefd_weof (tapeio.c:694) ==13968== by 0x103B: do_pass0 (tapetype.c:263) ==13968== by 0x1999: main (tapetype.c:492) ==13968== Address 0xBEBC67BE is on thread 1's stack Writing 256 Mbyte uncompresseable data: 45 sec Estimated time to write 2 * 40960 Mbyte: 14400 sec = 4 h 0 min ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x4844543: tapefd_rewind (tapeio.c:632) ==13968== by 0x1154: do_pass (tapetype.c:197) ==13968== by 0x1B71: main (tapetype.c:536) ==13968== Address 0xBEBC67C6 is on thread 1's stack ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x48443AA: tapefd_weof (tapeio.c:694) ==13968== by 0x11A0: do_pass (tapetype.c:207) ==13968== by 0x1B71: main (tapetype.c:536) ==13968== Address 0xBEBC67BE is on thread 1's stack wrote 1218951 32Kb blocks in 93 files in 6860 seconds (short write) ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x4844543: tapefd_rewind (tapeio.c:632) ==13968== by 0x1154: do_pass (tapetype.c:197) ==13968== by 0x1B91: main (tapetype.c:542) ==13968== Address 0xBEBC67C6 is on thread 1's stack ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x48443AA: tapefd_weof (tapeio.c:694) ==13968== by 0x11A0: do_pass (tapetype.c:207) ==13968== by 0x1B91: main (tapetype.c:542) ==13968== Address 0xBEBC67BE is on thread 1's stack wrote 1225411 32Kb blocks in 187 files in 7053 seconds (short write) define tapetype DLT8000 { comment "just produced by tapetype prog (hardware compression off)" length 38193 mbytes filemark 0 kbytes speed 5622 kps } ==13968== ==13968== Syscall param ioctl(generic) points to uninitialised byte(s) ==13968== at 0x49A5299: ioctl (in /lib/libc-2.5.so) ==13968== by 0x4844543: tapefd_rewind (tapeio.c:632) ==13968== by 0x1D55: main (tapetype.c:604) ==13968== Address 0xBEBC6806 is on thread 1's stack ==13968== ==13968== Invalid free() / delete / delete[] ==13968== at 0x4820FDA: free (vg_replace_malloc.c:233) ==13968== by 0x1D83: main (tapetype.c:618) ==13968== Address 0x4B21000 is 4,056 bytes inside a block of size 1,052,672 alloc'd ==13968== at 0x48213C0: malloc (vg_replace_malloc.c:149) ==13968== by 0x484D46F: debug_alloc (alloc.c:185) ==13968== by 0xD17: allocrandombytes (tapetype.c:71) ==13968== by 0x179B: main (tapetype.c:86) ==13968== ==13968== ERROR SUMMARY: 301 errors from 14 contexts (suppressed: 24 from 1) ==13968== malloc/free: in use at exit: 1,053,128 bytes in 6 blocks. ==13968== malloc/free: 9 allocs, 4 frees, 1,118,673 bytes allocated. ==13968== For counts of detected errors, rerun with: -v ==13968== searching for pointers to 6 not-freed blocks. ==13968== checked 1,267,908 bytes. ==13968== ==13968== ==13968== 27 bytes in 2 blocks are definitely lost in loss record 1 of 2 ==13968== at 0x48213C0: malloc (vg_replace_malloc.c:149) ==13968== by 0x484D46F: debug_alloc (alloc.c:185) ==13968== by 0x484D94D: debug_stralloc (alloc.c:230) ==13968== by 0x1569: main (tapetype.c:364) ==13968== ==13968== LEAK SUMMARY: ==13968== definitely lost: 27 bytes in 2 blocks. ==13968== possibly lost: 0 bytes in 0 blocks. ==13968== still reachable: 1,053,101 bytes in 4 blocks. ==13968== suppressed: 0 bytes in 0 blocks. ==13968== Reachable blocks (those to which a pointer was found) are not shown. ==13968== To see them, rerun with: --show-reachable=yes # Error output: # mt -f /dev/st0 rewind # mt -f /dev/nst0 compression 0 # mt -f /dev/nst0 setblk 0 # amtapetype -o -t DLT8000 -e 40g -f /dev/nst0 unknown: strange amanda header: "" Writing 256 Mbyte compresseable data: 45 sec Writing 256 Mbyte uncompresseable data: 45 sec Estimated time to write 2 * 40960 Mbyte: 14400 sec = 4 h 0 min wrote 1218951 32Kb blocks in 93 files in 6888 seconds (short write) wrote 1225411 32Kb blocks in 187 files in 7078 seconds (short write) define tapetype DLT8000 { comment "just produced by tapetype prog (hardware compression off)" length 38193 mbytes filemark 0 kbytes speed 5601 kps } *** glibc detected *** amtapetype: free(): invalid pointer: 0xb7deb000 *** ======= Backtrace: ========= /lib/libc.so.6[0x178b16] /lib/libc.so.6(cfree+0x90)[0x17c030] amtapetype(main+0xa04)[0x7ade54] /lib/libc.so.6(__libc_start_main+0xdc)[0x125dec] amtapetype[0x7acc11] ======= Memory map: ======== 00110000-0024d000 r-xp 00000000 fd:00 524154 /lib/libc-2.5.so 0024d000-0024f000 r-xp 0013d000 fd:00 524154 /lib/libc-2.5.so 0024f000-00250000 rwxp 0013f000 fd:00 524154 /lib/libc-2.5.so 00250000-00253000 rwxp 00250000 00:00 0 00498000-004a3000 r-xp 00000000 fd:00 523473 /lib/libgcc_s-4.1.2-20080102.so.1 004a3000-004a4000 rwxp 0000a000 fd:00 523473 /lib/libgcc_s-4.1.2-20080102.so.1 004db000-004fc000 r-xp 00000000 fd:00 4688711 /usr/lib/libamanda-2.5.0p2.so 004fc000-004fd000 rwxp 00021000 fd:00 4688711 /usr/lib/libamanda-2.5.0p2.so 004fd000-0051c000 rwxp 004fd000 00:00 0 006a3000-006b2000 r-xp 00000000 fd:00 524163 /lib/libresolv-2.5.so 006b2000-006b3000 r-xp 0000e000 fd:00 524163 /lib/libresolv-2.5.so 006b3000-006b4000 rwxp 0000f000 fd:00 524163 /lib/libresolv-2.5.so 006b4000-006b6000 rwxp 006b4000 00:00 0 0074a000-0074b000 r-xp 0074a000 00:00 0 [vdso] 007ac000-007af000 r-xp 00000000 fd:00 4705785 /usr/sbin/amtapetype 007af000-007b0000 rwxp 00002000 fd:00 4705785 /usr/sbin/amtapetype 007dd000-007e0000 r-xp 00000000 fd:00 524176 /lib/libtermcap.so.2.0.8 007e0000-007e1000 rwxp 00002000 fd:00 524176 /lib/libtermcap.so.2.0.8 00934000-0093e000 r-xp 00000000 fd:00 4705401 /usr/lib/libamtape-2.5.0p2.so 0093e000-0093f000 rwxp 00009000 fd:00 4705401 /usr/lib/libamtape-2.5.0p2.so 00a0f000-00a22000 r-xp 00000000 fd:00 524169 /lib/libnsl-2.5.so 00a22000-00a23000 r-xp 00012000 fd:00 524169 /lib/libnsl-2.5.so 00a23000-00a24000 rwxp 00013000 fd:00 524169 /lib/libnsl-2.5.so 00a24000-00a26000 rwxp 00a24000 00:00 0 00c75000-00c8f000 r-xp 00000000 fd:00 523299 /lib/ld-2.5.so 00c8f000-00c90000 r-xp 00019000 fd:00 523299 /lib/ld-2.5.so 00c90000-00c91000 rwxp 0001a000 fd:00 523299 /lib/ld-2.5.so 00e90000-00eb5000 r-xp 00000000 fd:00 523316 /lib/libm-2.5.so 00eb5000-00eb6000 r-xp 00024000 fd:00 523316 /lib/libm-2.5.so 00eb6000-00eb7000 rwxp 00025000 fd:00 523316 /lib/libm-2.5.so 081f9000-0821a000 rw-p 081f9000 00:00 0 b7c00000-b7c21000 rw-p b7c00000 00:00 0 b7c21000-b7d00000 ---p b7c21000 00:00 0 b7dea000-b7eef000 rw-p b7dea000 00:00 0 b7f07000-b7f08000 rw-p b7f07000 00:00 0 bfbff000-bfc14000 rw-p bfbff000 00:00 0 [stack] Abgebrochen # Version-Release number of selected component (if applicable): 2.5.0-p2 How reproducible: 100% Steps to Reproduce: # mt -f /dev/st0 status SCSI 2 tape drive: File number=0, block number=0, partition=0. Tape block size 0 bytes. Density code 0x41 (DLT 40GB, or Ultrium2). Soft error count since last status=0 General status bits on (41010000): BOT ONLINE IM_REP_EN # mt -f /dev/st0 rewind # mt -f /dev/nst0 compression 0 # mt -f /dev/nst0 setblk 0 # amtapetype -o -t DLT8000 -e 40g -f /dev/nst0 Actual results: see description Expected results: complete without failure Additional info: Upstream seems to remove free'ing of the randombytes pointer.
I see something similar: # amtapetype -o -t IBM-ULTRIUM-TD2 -e 200g -f /dev/nst0 Writing 2048 Mbyte compresseable data: 66 sec Writing 2048 Mbyte uncompresseable data: 65 sec Estimated time to write 2 * 204800 Mbyte: 13000 sec = 3 h 36 min wrote 6422528 32Kb blocks in 98 files in 6433 seconds (short write) wrote 6455296 32Kb blocks in 197 files in 6754 seconds (short write) define tapetype IBM-ULTRIUM-TD2 { comment "just produced by tapetype prog (hardware compression off)" length 201216 mbytes filemark 0 kbytes speed 31266 kps } *** glibc detected *** amtapetype: free(): invalid pointer: 0x00002b0071a52000 *** ======= Backtrace: ========= /lib64/libc.so.6[0x2b007176c834] /lib64/libc.so.6(cfree+0x8c)[0x2b007176fe7c] amtapetype(main+0x982)[0x2b00705c0042] /lib64/libc.so.6(__libc_start_main+0xf4)[0x2b00717188b4] amtapetype[0x2b00705bf049] ======= Memory map: ======== 2b00705be000-2b00705c1000 r-xp 00000000 fd:00 6976622 /usr/sbin/amtapetype 2b00707c1000-2b00707c2000 rw-p 00003000 fd:00 6976622 /usr/sbin/amtapetype 2b00707c2000-2b00707dc000 r-xp 00000000 fd:00 5832906 /lib64/ld-2.5.so 2b00707dc000-2b00707de000 rw-p 2b00707dc000 00:00 0 2b00709dc000-2b00709dd000 r--p 0001a000 fd:00 5832906 /lib64/ld-2.5.so 2b00709dd000-2b00709de000 rw-p 0001b000 fd:00 5832906 /lib64/ld-2.5.so 2b00709de000-2b00709e8000 r-xp 00000000 fd:00 6976744 /usr/lib64/libamtape-2.5.0p2.so 2b00709e8000-2b0070be8000 ---p 0000a000 fd:00 6976744 /usr/lib64/libamtape-2.5.0p2.so 2b0070be8000-2b0070be9000 rw-p 0000a000 fd:00 6976744 /usr/lib64/libamtape-2.5.0p2.so 2b0070be9000-2b0070c0b000 r-xp 00000000 fd:00 6967166 /usr/lib64/libamanda-2.5.0p2.so 2b0070c0b000-2b0070e0b000 ---p 00022000 fd:00 6967166 /usr/lib64/libamanda-2.5.0p2.so 2b0070e0b000-2b0070e0d000 rw-p 00022000 fd:00 6967166 /usr/lib64/libamanda-2.5.0p2.so 2b0070e0d000-2b0070e2c000 rw-p 2b0070e0d000 00:00 0 2b0070e47000-2b0070ec9000 r-xp 00000000 fd:00 5832993 /lib64/libm-2.5.so 2b0070ec9000-2b00710c8000 ---p 00082000 fd:00 5832993 /lib64/libm-2.5.so 2b00710c8000-2b00710c9000 r--p 00081000 fd:00 5832993 /lib64/libm-2.5.so 2b00710c9000-2b00710ca000 rw-p 00082000 fd:00 5832993 /lib64/libm-2.5.so 2b00710ca000-2b00710cd000 r-xp 00000000 fd:00 5833046 /lib64/libtermcap.so.2.0.8 2b00710cd000-2b00712cc000 ---p 00003000 fd:00 5833046 /lib64/libtermcap.so.2.0.8 2b00712cc000-2b00712cd000 rw-p 00002000 fd:00 5833046 /lib64/libtermcap.so.2.0.8 2b00712cd000-2b00712ce000 rw-p 2b00712cd000 00:00 0 2b00712ce000-2b00712e3000 r-xp 00000000 fd:00 5833040 /lib64/libnsl-2.5.so 2b00712e3000-2b00714e2000 ---p 00015000 fd:00 5833040 /lib64/libnsl-2.5.so 2b00714e2000-2b00714e3000 r--p 00014000 fd:00 5833040 /lib64/libnsl-2.5.so 2b00714e3000-2b00714e4000 rw-p 00015000 fd:00 5833040 /lib64/libnsl-2.5.so 2b00714e4000-2b00714e6000 rw-p 2b00714e4000 00:00 0 2b00714e6000-2b00714f7000 r-xp 00000000 fd:00 5832911 /lib64/libresolv-2.5.so 2b00714f7000-2b00716f7000 ---p 00011000 fd:00 5832911 /lib64/libresolv-2.5.so 2b00716f7000-2b00716f8000 r--p 00011000 fd:00 5832911 /lib64/libresolv-2.5.so 2b00716f8000-2b00716f9000 rw-p 00012000 fd:00 5832911 /lib64/libresolv-2.5.so 2b00716f9000-2b00716fb000 rw-p 2b00716f9000 00:00 0 2b00716fb000-2b0071845000 r-xp 00000000 fd:00 5832909 /lib64/libc-2.5.so 2b0071845000-2b0071a45000 ---p 0014a000 fd:00 5832909 /lib64/libc-2.5.so 2b0071a45000-2b0071a49000 r--p 0014a000 fd:00 5832909 /lib64/libc-2.5.so 2b0071a49000-2b0071a4a000 rw-p 0014e000 fd:00 5832909 /lib64/libc-2.5.so 2b0071a4a000-2b0071b54000 rw-p 2b0071a4a000 00:00 0 2b0075d88000-2b0075da9000 rw-p 2b0075d88000 00:00 0 2b0075da9000-2b0075db6000 r-xp 00000000 fd:00 5832995 /lib64/libgcc_s-4.1.2-20080102.so.1 2b0075db6000-2b0075fb6000 ---p 0000d000 fd:00 5832995 /lib64/libgcc_s-4.1.2-20080102.so.1 2b0075fb6000-2b0075fb7000 rw-p 0000d000 fd:00 5832995 /lib64/libgcc_s-4.1.2-20080102.so.1 2b0078000000-2b0078021000 rw-p 2b0078000000 00:00 0 2b0078021000-2b007c000000 ---p 2b0078021000 00:00 0 7fff3a4d6000-7fff3a4ec000 rw-p 7fff3a4d6000 00:00 0 [stack] ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vdso] Aborted # rpm -q amanda-server amanda-server-2.5.0p2-4 # uname -a Linux beast.private.yuiop.co.uk 2.6.18-92.1.18.el5.centos.plusxen #1 SMP Wed Nov 26 08:00:55 EST 2008 x86_64 x86_64 x86_64 GNU/Linux Yes, I'm running CentOS, but I thought it was worth looking to see if anyone else had this, and reporting/confirming it anyway. Many thanks for your excellent work!
Created attachment 328715 [details] a patch we can remove free()ing of the randombytes pointer
Created attachment 335525 [details] a better patch it turns out the memory was allocated using the Amanda alloc() function, not malloc() therefore it has to be freed with the corresponding amfree() function and not free()
oops, seems that amfree() is just free() with some "failsafe" stuff around it... re-enabling previous patch
Created attachment 339443 [details] the patch revisited it turns out the pointer "randombytes" is aligned to page boundary after allocation: we have to free() the original pointer and not the aligned one
fixed in amanda-2.5.0p2-5.el5
~~ Attention - RHEL 5.4 Beta Released! ~~ RHEL 5.4 Beta has been released! There should be a fix present in the Beta release that addresses this particular request. Please test and report back results here, at your earliest convenience. RHEL 5.4 General Availability release is just around the corner! If you encounter any issues while testing Beta, please describe the issues you have encountered and set the bug into NEED_INFO. If you encounter new issues, please clone this bug to open a new issue and request it be reviewed for inclusion in RHEL 5.4 or a later update, if it is not of urgent severity. Please do not flip the bug status to VERIFIED. Only post your verification results, and if available, update Verified field with the appropriate value. Questions can be posted to this bug or your customer or partner representative.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2009-1300.html