|
 |
304803 |
autofs-5.0.7 - fix use cache entry after free mistake
|
|
|
304803 |
|
|
|
304803 |
From: Ian Kent <ikent@redhat.com>
|
|
|
304803 |
|
|
|
304803 |
Fix an obvious use after free mistake in lookup_prune_one_cache().
|
|
|
304803 |
---
|
|
|
304803 |
|
|
|
304803 |
CHANGELOG | 1 +
|
|
|
304803 |
daemon/lookup.c | 7 +++++--
|
|
|
304803 |
2 files changed, 6 insertions(+), 2 deletions(-)
|
|
|
304803 |
|
|
|
304803 |
|
|
|
304803 |
diff --git a/CHANGELOG b/CHANGELOG
|
|
|
304803 |
index faf4c80..dc38580 100644
|
|
|
304803 |
--- a/CHANGELOG
|
|
|
304803 |
+++ b/CHANGELOG
|
|
|
304803 |
@@ -1,6 +1,7 @@
|
|
|
304803 |
??/??/2012 autofs-5.0.8
|
|
|
304803 |
=======================
|
|
|
304803 |
- fix nobind sun escaped map entries.
|
|
|
304803 |
+- fix use cache entry after free in lookup_prune_one_cache().
|
|
|
304803 |
|
|
|
304803 |
25/07/2012 autofs-5.0.7
|
|
|
304803 |
=======================
|
|
|
304803 |
diff --git a/daemon/lookup.c b/daemon/lookup.c
|
|
|
304803 |
index 7909536..e3d9536 100644
|
|
|
304803 |
--- a/daemon/lookup.c
|
|
|
304803 |
+++ b/daemon/lookup.c
|
|
|
304803 |
@@ -1103,15 +1103,18 @@ void lookup_prune_one_cache(struct autofs_point *ap, struct mapent_cache *mc, ti
|
|
|
304803 |
if (valid)
|
|
|
304803 |
cache_delete(mc, key);
|
|
|
304803 |
else if (!is_mounted(_PROC_MOUNTS, path, MNTS_AUTOFS)) {
|
|
|
304803 |
+ dev_t devid = ap->dev;
|
|
|
304803 |
status = CHE_FAIL;
|
|
|
304803 |
+ if (ap->type == LKP_DIRECT)
|
|
|
304803 |
+ devid = this->dev;
|
|
|
304803 |
if (this->ioctlfd == -1)
|
|
|
304803 |
status = cache_delete(mc, key);
|
|
|
304803 |
if (status != CHE_FAIL) {
|
|
|
304803 |
if (ap->type == LKP_INDIRECT) {
|
|
|
304803 |
if (ap->flags & MOUNT_FLAG_GHOST)
|
|
|
304803 |
- rmdir_path(ap, path, ap->dev);
|
|
|
304803 |
+ rmdir_path(ap, path, devid);
|
|
|
304803 |
} else
|
|
|
304803 |
- rmdir_path(ap, path, this->dev);
|
|
|
304803 |
+ rmdir_path(ap, path, devid);
|
|
|
304803 |
}
|
|
|
304803 |
}
|
|
|
304803 |
cache_unlock(mc);
|