autofs-5.0.7 - fix file descriptor leak when reloading the daemon

From: Leonardo Chiquitto <leonardo.lists@gmail.com>

A customer reported that AutoFS may leak file descriptors when some
maps are modified and the daemon reloaded. I'm able to reproduce the
problem on 5.0.7 by following these steps:

1. Configure a simple direct mount:

# cat /etc/auto.master
/-	/etc/auto.direct

# cat /etc/auto.direct
/nfs   server:/nfs

2. Start the automounter and do NOT trigger the mount

3. Replace /etc/auto.direct with:

# cat /etc/auto.direct
/nfs/1  server:/nfs
/nfs/2  server:/nfs

4. Reload:

# kill -HUP $(pidof automount)

>From now on, every reload will leak a file descriptor:

# ls -la /proc/$(pidof automount)/fd | grep /nfs
lr-x------ 1 root root 64 Aug 14 22:08 11 -> /nfs
lr-x------ 1 root root 64 Aug 14 22:08 12 -> /nfs
lr-x------ 1 root root 64 Aug 14 22:08 13 -> /nfs
lr-x------ 1 root root 64 Aug 14 22:08 14 -> /nfs
lr-x------ 1 root root 64 Aug 14 22:08 5 -> /nfs

I've investigated the problem and discovered that the leak happens in
do_umount_autofs_direct():

- edit imk
The same leak is present in umount_autofs_offset() also.
Updated patch to cover that too.
- end edit

int do_umount_autofs_direct(struct autofs_point *ap, struct mnt_list
*mnts, struct mapent *me)
{
(...)
	if (me->ioctlfd != -1) {
		if (tree_is_mounted(mnts, me->key, MNTS_REAL)) {
			error(ap->logopt,
			      "attempt to umount busy direct mount %s",
			      me->key);
			return 1;
		}
		ioctlfd = me->ioctlfd;
	} else	// ioctlfd == -1
		ops->open(ap->logopt, &ioctlfd, me->dev, me->key);  <= we open it here

	if (ioctlfd >= 0) {
		unsigned int status = 1;

		rv = ops->askumount(ap->logopt, ioctlfd, &status);
				/// at this point, rv == 0 and status == 0
		if (rv) {
			char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
			error(ap->logopt, "ioctl failed: %s", estr);
			return 1;
		} else if (!status) {
				/// at this point, ap->state == ST_READMAP
			if (ap->state != ST_SHUTDOWN_FORCE) {
				error(ap->logopt,
				      "ask umount returned busy for %s",
				      me->key);
				return 1;			<= we return here, without closing the fd
			} else {
				me->ioctlfd = -1;
				ops->catatonic(ap->logopt, ioctlfd);
				ops->close(ap->logopt, ioctlfd);
				goto force_umount;
			}
(...)
---
 CHANGELOG       |    1 +
 daemon/direct.c |   19 ++++++++++++++++---
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 46ef335..a7ed212 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -30,6 +30,7 @@
 - workaround missing GNU versionsort extension.
 - dont fail on master map self include.
 - fix wildcard multi map regression.
+- fix file descriptor leak when reloading the daemon.
 
 25/07/2012 autofs-5.0.7
 =======================
diff --git a/daemon/direct.c b/daemon/direct.c
index 3e09c5d..228a666 100644
--- a/daemon/direct.c
+++ b/daemon/direct.c
@@ -86,7 +86,8 @@ int do_umount_autofs_direct(struct autofs_point *ap, struct mnt_list *mnts, stru
 {
 	struct ioctl_ops *ops = get_ioctl_ops();
 	char buf[MAX_ERR_BUF];
-	int ioctlfd, rv, left, retries;
+	int ioctlfd = -1, rv, left, retries;
+	int opened = 0;
 
 	left = umount_multi(ap, me->key, 0);
 	if (left) {
@@ -103,8 +104,10 @@ int do_umount_autofs_direct(struct autofs_point *ap, struct mnt_list *mnts, stru
 			return 1;
 		}
 		ioctlfd = me->ioctlfd;
-	} else
+	} else {
 		ops->open(ap->logopt, &ioctlfd, me->dev, me->key);
+		opened = 1;
+	}
 
 	if (ioctlfd >= 0) {
 		unsigned int status = 1;
@@ -113,12 +116,16 @@ int do_umount_autofs_direct(struct autofs_point *ap, struct mnt_list *mnts, stru
 		if (rv) {
 			char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 			error(ap->logopt, "ioctl failed: %s", estr);
+			if (opened && ioctlfd != -1)
+				ops->close(ap->logopt, ioctlfd);
 			return 1;
 		} else if (!status) {
 			if (ap->state != ST_SHUTDOWN_FORCE) {
 				error(ap->logopt,
 				      "ask umount returned busy for %s",
 				      me->key);
+				if (opened && ioctlfd != -1)
+					ops->close(ap->logopt, ioctlfd);
 				return 1;
 			} else {
 				me->ioctlfd = -1;
@@ -536,7 +543,8 @@ int umount_autofs_offset(struct autofs_point *ap, struct mapent *me)
 {
 	struct ioctl_ops *ops = get_ioctl_ops();
 	char buf[MAX_ERR_BUF];
-	int ioctlfd, rv = 1, retries;
+	int ioctlfd = -1, rv = 1, retries;
+	int opened = 0;
 
 	if (me->ioctlfd != -1) {
 		if (is_mounted(_PATH_MOUNTED, me->key, MNTS_REAL)) {
@@ -554,6 +562,7 @@ int umount_autofs_offset(struct autofs_point *ap, struct mapent *me)
 			return 0;
 		}
 		ops->open(ap->logopt, &ioctlfd, me->dev, me->key);
+		opened = 1;
 	}
 
 	if (ioctlfd >= 0) {
@@ -563,6 +572,8 @@ int umount_autofs_offset(struct autofs_point *ap, struct mapent *me)
 		if (rv) {
 			char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 			logerr("ioctl failed: %s", estr);
+			if (opened && ioctlfd != -1)
+				ops->close(ap->logopt, ioctlfd);
 			return 1;
 		} else if (!status) {
 			if (ap->state != ST_SHUTDOWN_FORCE) {
@@ -570,6 +581,8 @@ int umount_autofs_offset(struct autofs_point *ap, struct mapent *me)
 					error(ap->logopt,
 					     "ask umount returned busy for %s",
 					     me->key);
+				if (opened && ioctlfd != -1)
+					ops->close(ap->logopt, ioctlfd);
 				return 1;
 			} else {
 				me->ioctlfd = -1;