|
 |
803fb7 |
From 7ac4fc60181cfc7ff06e696da78e1b2819580745 Mon Sep 17 00:00:00 2001
|
|
|
803fb7 |
From: Evgeny Vereshchagin <evvers@ya.ru>
|
|
|
803fb7 |
Date: Mon, 9 Jan 2017 04:46:11 +0000
|
|
|
803fb7 |
Subject: [PATCH] shared: fix double free in link
|
|
|
803fb7 |
|
|
|
803fb7 |
Fixes:
|
|
|
803fb7 |
```
|
|
|
803fb7 |
touch hola.service
|
|
|
803fb7 |
systemctl link $(pwd)/hola.service $(pwd)/hola.service
|
|
|
803fb7 |
```
|
|
|
803fb7 |
|
|
|
803fb7 |
```
|
|
|
803fb7 |
==1==ERROR: AddressSanitizer: attempting double-free on 0x60300002c560 in thread T0 (systemd):
|
|
|
803fb7 |
#0 0x7fc8c961cb00 in free (/lib64/libasan.so.3+0xc6b00)
|
|
|
803fb7 |
#1 0x7fc8c90ebd3b in strv_clear src/basic/strv.c:83
|
|
|
803fb7 |
#2 0x7fc8c90ebdb6 in strv_free src/basic/strv.c:89
|
|
|
803fb7 |
#3 0x55637c758c77 in strv_freep src/basic/strv.h:37
|
|
|
803fb7 |
#4 0x55637c763ba9 in method_enable_unit_files_generic src/core/dbus-manager.c:1960
|
|
|
803fb7 |
#5 0x55637c763d16 in method_link_unit_files src/core/dbus-manager.c:2001
|
|
|
803fb7 |
#6 0x7fc8c92537ec in method_callbacks_run src/libsystemd/sd-bus/bus-objects.c:418
|
|
|
803fb7 |
#7 0x7fc8c9258830 in object_find_and_run src/libsystemd/sd-bus/bus-objects.c:1255
|
|
|
803fb7 |
#8 0x7fc8c92594d7 in bus_process_object src/libsystemd/sd-bus/bus-objects.c:1371
|
|
|
803fb7 |
#9 0x7fc8c91e7553 in process_message src/libsystemd/sd-bus/sd-bus.c:2563
|
|
|
803fb7 |
#10 0x7fc8c91e78ce in process_running src/libsystemd/sd-bus/sd-bus.c:2605
|
|
|
803fb7 |
#11 0x7fc8c91e8f61 in bus_process_internal src/libsystemd/sd-bus/sd-bus.c:2837
|
|
|
803fb7 |
#12 0x7fc8c91e90d2 in sd_bus_process src/libsystemd/sd-bus/sd-bus.c:2856
|
|
|
803fb7 |
#13 0x7fc8c91ea8f9 in io_callback src/libsystemd/sd-bus/sd-bus.c:3126
|
|
|
803fb7 |
#14 0x7fc8c928333b in source_dispatch src/libsystemd/sd-event/sd-event.c:2268
|
|
|
803fb7 |
#15 0x7fc8c9285cf7 in sd_event_dispatch src/libsystemd/sd-event/sd-event.c:2627
|
|
|
803fb7 |
#16 0x7fc8c92865fa in sd_event_run src/libsystemd/sd-event/sd-event.c:2686
|
|
|
803fb7 |
#17 0x55637c6b5257 in manager_loop src/core/manager.c:2274
|
|
|
803fb7 |
#18 0x55637c6a2194 in main src/core/main.c:1920
|
|
|
803fb7 |
#19 0x7fc8c7ac7400 in __libc_start_main (/lib64/libc.so.6+0x20400)
|
|
|
803fb7 |
#20 0x55637c697339 in _start (/usr/lib/systemd/systemd+0xcd339)
|
|
|
803fb7 |
|
|
|
803fb7 |
0x60300002c560 is located 0 bytes inside of 19-byte region [0x60300002c560,0x60300002c573)
|
|
|
803fb7 |
freed by thread T0 (systemd) here:
|
|
|
803fb7 |
#0 0x7fc8c961cb00 in free (/lib64/libasan.so.3+0xc6b00)
|
|
|
803fb7 |
#1 0x7fc8c90ee320 in strv_remove src/basic/strv.c:630
|
|
|
803fb7 |
#2 0x7fc8c90ee190 in strv_uniq src/basic/strv.c:602
|
|
|
803fb7 |
#3 0x7fc8c9180533 in unit_file_link src/shared/install.c:1996
|
|
|
803fb7 |
#4 0x55637c763b25 in method_enable_unit_files_generic src/core/dbus-manager.c:1985
|
|
|
803fb7 |
#5 0x55637c763d16 in method_link_unit_files src/core/dbus-manager.c:2001
|
|
|
803fb7 |
#6 0x7fc8c92537ec in method_callbacks_run src/libsystemd/sd-bus/bus-objects.c:418
|
|
|
803fb7 |
#7 0x7fc8c9258830 in object_find_and_run src/libsystemd/sd-bus/bus-objects.c:1255
|
|
|
803fb7 |
#8 0x7fc8c92594d7 in bus_process_object src/libsystemd/sd-bus/bus-objects.c:1371
|
|
|
803fb7 |
#9 0x7fc8c91e7553 in process_message src/libsystemd/sd-bus/sd-bus.c:2563
|
|
|
803fb7 |
#10 0x7fc8c91e78ce in process_running src/libsystemd/sd-bus/sd-bus.c:2605
|
|
|
803fb7 |
#11 0x7fc8c91e8f61 in bus_process_internal src/libsystemd/sd-bus/sd-bus.c:2837
|
|
|
803fb7 |
#12 0x7fc8c91e90d2 in sd_bus_process src/libsystemd/sd-bus/sd-bus.c:2856
|
|
|
803fb7 |
#13 0x7fc8c91ea8f9 in io_callback src/libsystemd/sd-bus/sd-bus.c:3126
|
|
|
803fb7 |
#14 0x7fc8c928333b in source_dispatch src/libsystemd/sd-event/sd-event.c:2268
|
|
|
803fb7 |
#15 0x7fc8c9285cf7 in sd_event_dispatch src/libsystemd/sd-event/sd-event.c:2627
|
|
|
803fb7 |
#16 0x7fc8c92865fa in sd_event_run src/libsystemd/sd-event/sd-event.c:2686
|
|
|
803fb7 |
#17 0x55637c6b5257 in manager_loop src/core/manager.c:2274
|
|
|
803fb7 |
#18 0x55637c6a2194 in main src/core/main.c:1920
|
|
|
803fb7 |
#19 0x7fc8c7ac7400 in __libc_start_main (/lib64/libc.so.6+0x20400)
|
|
|
803fb7 |
|
|
|
803fb7 |
previously allocated by thread T0 (systemd) here:
|
|
|
803fb7 |
#0 0x7fc8c95b0160 in strdup (/lib64/libasan.so.3+0x5a160)
|
|
|
803fb7 |
#1 0x7fc8c90edf32 in strv_extend src/basic/strv.c:552
|
|
|
803fb7 |
#2 0x7fc8c923ae41 in bus_message_read_strv_extend src/libsystemd/sd-bus/bus-message.c:5578
|
|
|
803fb7 |
#3 0x7fc8c923b0de in sd_bus_message_read_strv src/libsystemd/sd-bus/bus-message.c:5600
|
|
|
803fb7 |
#4 0x55637c7639d1 in method_enable_unit_files_generic src/core/dbus-manager.c:1969
|
|
|
803fb7 |
#5 0x55637c763d16 in method_link_unit_files src/core/dbus-manager.c:2001
|
|
|
803fb7 |
#6 0x7fc8c92537ec in method_callbacks_run src/libsystemd/sd-bus/bus-objects.c:418
|
|
|
803fb7 |
#7 0x7fc8c9258830 in object_find_and_run src/libsystemd/sd-bus/bus-objects.c:1255
|
|
|
803fb7 |
#8 0x7fc8c92594d7 in bus_process_object src/libsystemd/sd-bus/bus-objects.c:1371
|
|
|
803fb7 |
#9 0x7fc8c91e7553 in process_message src/libsystemd/sd-bus/sd-bus.c:2563
|
|
|
803fb7 |
#10 0x7fc8c91e78ce in process_running src/libsystemd/sd-bus/sd-bus.c:2605
|
|
|
803fb7 |
#11 0x7fc8c91e8f61 in bus_process_internal src/libsystemd/sd-bus/sd-bus.c:2837
|
|
|
803fb7 |
#12 0x7fc8c91e90d2 in sd_bus_process src/libsystemd/sd-bus/sd-bus.c:2856
|
|
|
803fb7 |
#13 0x7fc8c91ea8f9 in io_callback src/libsystemd/sd-bus/sd-bus.c:3126
|
|
|
803fb7 |
#14 0x7fc8c928333b in source_dispatch src/libsystemd/sd-event/sd-event.c:2268
|
|
|
803fb7 |
#15 0x7fc8c9285cf7 in sd_event_dispatch src/libsystemd/sd-event/sd-event.c:2627
|
|
|
803fb7 |
#16 0x7fc8c92865fa in sd_event_run src/libsystemd/sd-event/sd-event.c:2686
|
|
|
803fb7 |
#17 0x55637c6b5257 in manager_loop src/core/manager.c:2274
|
|
|
803fb7 |
#18 0x55637c6a2194 in main src/core/main.c:1920
|
|
|
803fb7 |
#19 0x7fc8c7ac7400 in __libc_start_main (/lib64/libc.so.6+0x20400)
|
|
|
803fb7 |
|
|
|
803fb7 |
SUMMARY: AddressSanitizer: double-free (/lib64/libasan.so.3+0xc6b00) in free
|
|
|
803fb7 |
==1==ABORTING
|
|
|
803fb7 |
```
|
|
|
803fb7 |
|
|
|
803fb7 |
Closes #5015
|
|
|
803fb7 |
|
|
|
803fb7 |
(cherry picked from commit 8af35ba681116eb79a46e3dbd65b166c1efd6164)
|
|
|
803fb7 |
Related: #1409997
|
|
|
803fb7 |
---
|
|
|
803fb7 |
src/shared/install.c | 8 ++++++--
|
|
|
803fb7 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
803fb7 |
|
|
|
803fb7 |
diff --git a/src/shared/install.c b/src/shared/install.c
|
|
|
803fb7 |
index 1b59a96b1..87d805c94 100644
|
|
|
803fb7 |
--- a/src/shared/install.c
|
|
|
803fb7 |
+++ b/src/shared/install.c
|
|
|
803fb7 |
@@ -1682,7 +1682,7 @@ int unit_file_link(
|
|
|
803fb7 |
|
|
|
803fb7 |
_cleanup_lookup_paths_free_ LookupPaths paths = {};
|
|
|
803fb7 |
_cleanup_free_ char *config_path = NULL;
|
|
|
803fb7 |
- _cleanup_free_ char **todo = NULL;
|
|
|
803fb7 |
+ _cleanup_strv_free_ char **todo = NULL;
|
|
|
803fb7 |
size_t n_todo = 0, n_allocated = 0;
|
|
|
803fb7 |
char **i;
|
|
|
803fb7 |
int r,q;
|
|
|
803fb7 |
@@ -1736,7 +1736,11 @@ int unit_file_link(
|
|
|
803fb7 |
if (!GREEDY_REALLOC0(todo, n_allocated, n_todo + 2))
|
|
|
803fb7 |
return -ENOMEM;
|
|
|
803fb7 |
|
|
|
803fb7 |
- todo[n_todo++] = *i;
|
|
|
803fb7 |
+ todo[n_todo] = strdup(*i);
|
|
|
803fb7 |
+ if (!todo[n_todo])
|
|
|
803fb7 |
+ return -ENOMEM;
|
|
|
803fb7 |
+
|
|
|
803fb7 |
+ n_todo++;
|
|
|
803fb7 |
}
|
|
|
803fb7 |
|
|
|
803fb7 |
strv_uniq(todo);
|