lxcfs/0006-set-null-after-free.patch
vegbir 9cae669874 upgrade to 5.0.4
Signed-off-by: vegbir <yangjiaqi16@huawei.com>
2023-07-29 09:15:09 +00:00

283 lines
6.7 KiB
Diff

From 6a744fd9ba541e535e611f066c4038330605fe2b Mon Sep 17 00:00:00 2001
From: vegbir <yangjiaqi16@huawei.com>
Date: Wed, 12 Jul 2023 07:48:40 +0000
Subject: [PATCH 06/15] set null after free
Signed-off-by: vegbir <yangjiaqi16@huawei.com>
---
src/cgroup_fuse.c | 27 ++++++++++++++++++++++-----
src/cgroups/cgfsng.c | 5 ++++-
src/cgroups/cgroup_utils.c | 4 +++-
src/lxcfs.c | 4 ++++
src/memory_utils.h | 4 +++-
src/proc_loadavg.c | 5 ++++-
6 files changed, 40 insertions(+), 9 deletions(-)
diff --git a/src/cgroup_fuse.c b/src/cgroup_fuse.c
index 693b67d..0d4dd10 100644
--- a/src/cgroup_fuse.c
+++ b/src/cgroup_fuse.c
@@ -179,7 +179,7 @@ static bool is_child_cgroup(const char *controller, const char *cgroup,
static bool caller_may_see_dir(pid_t pid, const char *contrl, const char *cg)
{
bool answer = false;
- char *c2, *task_cg;
+ char *c2 = NULL, *task_cg = NULL;
size_t target_len, task_len;
if (strcmp(cg, "/") == 0 || strcmp(cg, "./") == 0)
@@ -221,6 +221,7 @@ static bool caller_may_see_dir(pid_t pid, const char *contrl, const char *cg)
out:
free(c2);
+ c2 = NULL;
return answer;
}
@@ -260,8 +261,8 @@ static char *get_next_cgroup_dir(const char *taskcg, const char *querycg)
static bool caller_is_in_ancestor(pid_t pid, const char *contrl, const char *cg, char **nextcg)
{
bool answer = false;
- char *c2;
- char *linecmp;
+ char *c2 = NULL;
+ char *linecmp = NULL;
c2 = get_pid_cgroup_handle_named(pid, contrl);
if (!c2)
@@ -291,6 +292,7 @@ static bool caller_is_in_ancestor(pid_t pid, const char *contrl, const char *cg,
out:
free(c2);
+ c2 = NULL;
return answer;
}
@@ -613,6 +615,7 @@ __lxcfs_fuse_ops int cg_getattr(const char *path, struct stat *sb)
out:
free(cgdir);
+ cgdir = NULL;
return ret;
}
@@ -735,7 +738,9 @@ __lxcfs_fuse_ops int cg_mkdir(const char *path, mode_t mode)
out:
free(cgdir);
+ cgdir = NULL;
free(next);
+ next = NULL;
return ret;
}
@@ -870,7 +875,9 @@ __lxcfs_fuse_ops int cg_rmdir(const char *path)
out:
free(cgdir);
+ cgdir = NULL;
free(next);
+ next = NULL;
return ret;
}
@@ -959,6 +966,7 @@ __lxcfs_fuse_ops int cg_chmod(const char *path, mode_t mode)
out:
free_key(k);
free(cgdir);
+ cgdir = NULL;
return ret;
}
@@ -1068,7 +1076,7 @@ __lxcfs_fuse_ops int cg_chown(const char *path, uid_t uid, gid_t gid)
out:
free_key(k);
free(cgdir);
-
+ cgdir = NULL;
return ret;
}
@@ -1140,6 +1148,7 @@ __lxcfs_fuse_ops int cg_open(const char *path, struct fuse_file_info *fi)
out:
free(cgdir);
+ cgdir = NULL;
return ret;
}
@@ -1281,6 +1290,7 @@ static bool do_read_pids(pid_t tpid, const char *contrl, const char *cg,
if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sock) < 0) {
perror("socketpair");
free(tmpdata);
+ tmpdata = NULL;
return false;
}
@@ -1332,6 +1342,7 @@ next:
out:
free(tmpdata);
+ tmpdata = NULL;
if (cpid != -1)
wait_for_pid(cpid);
if (sock[0] != -1) {
@@ -1409,6 +1420,7 @@ __lxcfs_fuse_ops int cg_read(const char *path, char *buf, size_t size,
out:
free(data);
+ data = NULL;
return ret;
}
@@ -1995,6 +2007,7 @@ __lxcfs_fuse_ops int cg_readdir(const char *path, void *buf,
if (nextcg) {
ret = dir_filler(filler, buf, nextcg, 0);
free(nextcg);
+ nextcg = NULL;
if (ret != 0) {
ret = -EIO;
goto out;
@@ -2030,9 +2043,12 @@ __lxcfs_fuse_ops int cg_readdir(const char *path, void *buf,
out:
free_keys(list);
if (clist) {
- for (i = 0; clist[i]; i++)
+ for (i = 0; clist[i]; i++) {
free(clist[i]);
+ clist[i] = NULL;
+ }
free(clist);
+ clist = NULL;
}
return ret;
}
@@ -2101,5 +2117,6 @@ __lxcfs_fuse_ops int cg_access(const char *path, int mode)
out:
free(cgdir);
+ cgdir = NULL;
return ret;
}
diff --git a/src/cgroups/cgfsng.c b/src/cgroups/cgfsng.c
index 72a4503..e2d9807 100644
--- a/src/cgroups/cgfsng.c
+++ b/src/cgroups/cgfsng.c
@@ -891,7 +891,7 @@ static int cg_hybrid_init(struct cgroup_ops *ops)
prune_init_scope(base_cgroup);
if (type == CGROUP2_SUPER_MAGIC) {
- char *cgv2_ctrl_path;
+ char *cgv2_ctrl_path = NULL;
cgv2_ctrl_path = must_make_path(mountpoint, base_cgroup,
"cgroup.controllers",
@@ -899,6 +899,7 @@ static int cg_hybrid_init(struct cgroup_ops *ops)
controller_list = cg_unified_get_controllers(cgv2_ctrl_path);
free(cgv2_ctrl_path);
+ cgv2_ctrl_path = NULL;
if (!controller_list)
controller_list = cg_unified_make_empty_controller();
}
@@ -913,7 +914,9 @@ static int cg_hybrid_init(struct cgroup_ops *ops)
next:
free_string_list(controller_list);
free(mountpoint);
+ mountpoint = NULL;
free(base_cgroup);
+ base_cgroup = NULL;
}
free_string_list(klist);
diff --git a/src/cgroups/cgroup_utils.c b/src/cgroups/cgroup_utils.c
index 1224971..d32a520 100644
--- a/src/cgroups/cgroup_utils.c
+++ b/src/cgroups/cgroup_utils.c
@@ -701,7 +701,7 @@ bool mkdir_p(const char *dir, mode_t mode)
{
const char *tmp = dir;
const char *orig = dir;
- char *makeme;
+ char *makeme = NULL;
do {
dir = tmp + strspn(tmp, "/");
@@ -713,9 +713,11 @@ bool mkdir_p(const char *dir, mode_t mode)
lxcfs_error("Failed to create directory '%s': %s.\n",
makeme, strerror(errno));
free(makeme);
+ makeme = NULL;
return false;
}
free(makeme);
+ makeme = NULL;
} while(tmp != dir);
return true;
diff --git a/src/lxcfs.c b/src/lxcfs.c
index 92ed991..e9155ca 100644
--- a/src/lxcfs.c
+++ b/src/lxcfs.c
@@ -1357,10 +1357,12 @@ int main(int argc, char *argv[])
if (append_comma_separate(&new_fuse_opts, token)) {
lxcfs_error("Failed to copy fuse argument \"%s\"", token);
free(dup);
+ dup = NULL;
goto out;
}
}
free(dup);
+ dup = NULL;
}
if (append_comma_separate(&new_fuse_opts, "allow_other,entry_timeout=0.5,attr_timeout=0.5")) {
@@ -1426,7 +1428,9 @@ out:
if (pidfile)
unlink(pidfile);
free(new_fuse_opts);
+ new_fuse_opts = NULL;
free(opts);
+ opts = NULL;
close_prot_errno_disarm(pidfile_fd);
exit(ret);
}
diff --git a/src/memory_utils.h b/src/memory_utils.h
index c689c8e..13343e1 100644
--- a/src/memory_utils.h
+++ b/src/memory_utils.h
@@ -67,8 +67,10 @@ static inline void free_disarm_function(void *ptr)
static inline void free_string_list(char **list)
{
if (list) {
- for (int i = 0; list[i]; i++)
+ for (int i = 0; list[i]; i++) {
free(list[i]);
+ list[i] = NULL;
+ }
free_disarm(list);
}
}
diff --git a/src/proc_loadavg.c b/src/proc_loadavg.c
index b7411c4..8cd1e02 100644
--- a/src/proc_loadavg.c
+++ b/src/proc_loadavg.c
@@ -436,10 +436,13 @@ static int refresh_load(struct load_node *p, const char *path)
p->last_pid = last_pid;
err_out:
- for (; i > 0; i--)
+ for (; i > 0; i--) {
free(idbuf[i - 1]);
+ idbuf[i - 1] = NULL;
+ }
out:
free(idbuf);
+ idbuf = NULL;
return sum;
}
--
2.41.0