diff options
| author | Lennart Poettering <lennart@poettering.net> | 2015-06-09 11:04:41 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2015-06-09 11:04:41 +0200 |
| commit | 4b955cb9bc40b508b1eef0b7751f26526a598743 (patch) | |
| tree | b53df8ab020c77234c21e4fd92c64a37d7d9d6d8 | |
| parent | fd3102491f6c031abefbe74f99a9f18fc3e35328 (diff) | |
| parent | 85d834ae8e7d9e2c28ef8c1388e2913ed8fd0e3b (diff) | |
Merge pull request #118 from haraldh/set_consume2
util:bind_remount_recursive() fix "use after free" - 2
| -rw-r--r-- | src/shared/util.c | 17 |
1 files changed, 6 insertions, 11 deletions
diff --git a/src/shared/util.c b/src/shared/util.c index 1442301cd7..dc5e938796 100644 --- a/src/shared/util.c +++ b/src/shared/util.c @@ -4931,15 +4931,11 @@ int bind_remount_recursive(const char *prefix, bool ro) { while ((x = set_steal_first(todo))) { - r = set_put(done, x); - if (r == -EEXIST) { - free(x); + r = set_consume(done, x); + if (r == -EEXIST || r == 0) continue; - } - if (r < 0) { - free(x); + if (r < 0) return r; - } /* Try to reuse the original flag set, but * don't care for errors, in case of @@ -4949,15 +4945,14 @@ int bind_remount_recursive(const char *prefix, bool ro) { orig_flags &= ~MS_RDONLY; if (mount(NULL, x, NULL, orig_flags|MS_BIND|MS_REMOUNT|(ro ? MS_RDONLY : 0), NULL) < 0) { + /* Deal with mount points that are * obstructed by a later mount */ - if (errno != ENOENT) { - free(x); + if (errno != ENOENT) return -errno; - } } - free(x); + } } } |