packaging
/
ostree
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

deploy: Correctly use libmount unref() calls rather than free() 

We saw a random ostree SEGV start popping up in our CI environment:
https://github.com/projectatomic/rpm-ostree/pull/641#issuecomment-281870424

Looking at this code more and comparing it to what util-linux does, I noticed we
had a write-after-free, since `mnt_unref_table()` will invoke
`mnt_unref_cache()` on its cache, and that function does:

```
	if (cache) {
		cache->rfcount--;
```

unconditionally.

Fix this by using `unref()`.

Closes: #705
Approved by: jlebon
This commit is contained in:
Colin Walters 2017-02-23 09:40:17 -05:00 committed by Atomic Bot
parent 09b392675a
commit 0817be61a1
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/libostree/ostree-sysroot-deploy.c
View File

@ -1692,8 +1692,8 @@ is_ro_mount (const char *path)
fs = mnt_table_find_target(tb, path, MNT_ITER_BACKWARD); fs = mnt_table_find_target(tb, path, MNT_ITER_BACKWARD);
is_mount = fs && mnt_fs_get_target (fs); is_mount = fs && mnt_fs_get_target (fs);
mnt_free_cache (cache); mnt_unref_cache (cache);
mnt_free_table (tb); mnt_unref_table (tb);
if (!is_mount) if (!is_mount)
return FALSE; return FALSE;