shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-10-30 14:55:37 +03:00
Code

Merge pull request #21769 from yuwata/home-fix-heap-use-after-free

Browse Source 
home: fix heap-use-after-free
This commit is contained in:
Luca Boccassi 2021-12-14 15:54:00 +00:00 committed by GitHub
commit 020d41ce4f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/home/homed-home-bus.c
View File

@ -940,6 +940,12 @@ int bus_home_emit_remove(Home *h) {
if (!h->announced)
return 0;
if (!h->manager)
return 0;
if (!h->manager->bus)
return 0;
r = bus_home_path(h, &path);
if (r < 0)
return r;

14
src/home/homed-manager.c
View File

@ -253,8 +253,8 @@ Manager* manager_free(Manager *m) {
HASHMAP_FOREACH(h, m->homes_by_worker_pid)
(void) home_wait_for_worker(h);
sd_bus_flush_close_unref(m->bus);
bus_verify_polkit_async_registry_free(m->polkit_registry);
m->bus = sd_bus_flush_close_unref(m->bus);
m->polkit_registry = bus_verify_polkit_async_registry_free(m->polkit_registry);
m->device_monitor = sd_device_monitor_unref(m->device_monitor);
@ -265,12 +265,12 @@ Manager* manager_free(Manager *m) {
m->deferred_auto_login_event_source = sd_event_source_unref(m->deferred_auto_login_event_source);
m->rebalance_event_source = sd_event_source_unref(m->rebalance_event_source);
sd_event_unref(m->event);
m->event = sd_event_unref(m->event);
hashmap_free(m->homes_by_uid);
hashmap_free(m->homes_by_name);
hashmap_free(m->homes_by_worker_pid);
hashmap_free(m->homes_by_sysfs);
m->homes_by_uid = hashmap_free(m->homes_by_uid);
m->homes_by_name = hashmap_free(m->homes_by_name);
m->homes_by_worker_pid = hashmap_free(m->homes_by_worker_pid);
m->homes_by_sysfs = hashmap_free(m->homes_by_sysfs);
if (m->private_key)
EVP_PKEY_free(m->private_key);

7
src/shared/bus-polkit.c
View File

@ -408,8 +408,11 @@ int bus_verify_polkit_async(
return -EACCES;
}
void bus_verify_polkit_async_registry_free(Hashmap *registry) {
Hashmap *bus_verify_polkit_async_registry_free(Hashmap *registry) {
#if ENABLE_POLKIT
hashmap_free_with_destructor(registry, async_polkit_query_free);
return hashmap_free_with_destructor(registry, async_polkit_query_free);
#else
assert(hashmap_isempty(registry));
return hashmap_free(registry);
#endif
}

2
src/shared/bus-polkit.h
View File

@ -8,4 +8,4 @@
int bus_test_polkit(sd_bus_message *call, int capability, const char *action, const char **details, uid_t good_user, bool *_challenge, sd_bus_error *e);
int bus_verify_polkit_async(sd_bus_message *call, int capability, const char *action, const char **details, bool interactive, uid_t good_user, Hashmap **registry, sd_bus_error *error);
void bus_verify_polkit_async_registry_free(Hashmap *registry);
Hashmap *bus_verify_polkit_async_registry_free(Hashmap *registry);