autofs-5.1.9 - fix lookup_hosts module leaks read lock on early return From: Ian Kent If a master map internal hosts map entry constructed from an NFS export list results in an offset with the map entry mapent field being set to NULL (such as a mount failure) then the internal hosts map lookup_mount() function can return without releasing the cache readlock. While we're at it, I don't know why I used pthread_cleanup_push() and pthread_cleanup_pop() here, this function isn't subject to cancellation, so remove it and ensure mapent is NULL terminated. Reported-By: AISLE Research Fixes: 8fdc8adb55 ("autofs-5.1.9 - fix invalidated map entry handling in hosts module") Signed-off-by: Ian Kent --- CHANGELOG | 1 + modules/lookup_hosts.c | 10 ++++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 4663154e3..cb2bb586b 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -92,6 +92,7 @@ - fix handling of direct mount path in command handler. - fix useless complexity in get_proximity(). - fix buffer overflow in prepend_opt(). +- fix lookup_hosts module leaks read lock on early return. 02/11/2023 autofs-5.1.9 - fix kernel mount status notification. diff --git a/modules/lookup_hosts.c b/modules/lookup_hosts.c index fe40b9f18..360c2ccb7 100644 --- a/modules/lookup_hosts.c +++ b/modules/lookup_hosts.c @@ -431,14 +431,16 @@ int lookup_mount(struct autofs_point *ap, struct map_source *map, const char *na /* Multi-mounts must be able to ignore offsets that have * been auto-mounted by NFS itself. */ - if (!me->mapent) + if (!me->mapent) { + cache_unlock(mc); return NSS_STATUS_SUCCESS; - pthread_cleanup_push(cache_lock_cleanup, mc); + } mapent_len = strlen(me->mapent); mapent = malloc(mapent_len + 1); - if (mapent) + if (mapent) { strcpy(mapent, me->mapent); - pthread_cleanup_pop(0); + mapent[mapent_len] = 0; + } } cache_unlock(mc);