rpms/autofs/FC-6 autofs-5.0.1-rc2-fix-catch-global-options.patch, 1.1, 1.2 autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch, 1.1, 1.2 autofs-5.0.1-rc2-fix-use-after-free.patch, NONE, 1.1 autofs-5.0.1-rc2-parse-bad-master-map-mountpoint.patch, NONE, 1.1 autofs-5.0.1-rc2-use-task-done.patch, NONE, 1.1 autofs.spec, 1.156, 1.157

fedora-cvs-commits at redhat.com fedora-cvs-commits at redhat.com
Sat Nov 25 08:52:55 UTC 2006


Author: ikent

Update of /cvs/dist/rpms/autofs/FC-6
In directory cvs.devel.redhat.com:/tmp/cvs-serv32728

Modified Files:
	autofs.spec 
Added Files:
	autofs-5.0.1-rc2-fix-catch-global-options.patch 
	autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch 
	autofs-5.0.1-rc2-fix-use-after-free.patch 
	autofs-5.0.1-rc2-parse-bad-master-map-mountpoint.patch 
	autofs-5.0.1-rc2-use-task-done.patch 
Log Message:
* Sat Nov 25 2006 Ian Kent <ikent at redhat.com> - 5.0.1-0.rc2.25
- fix parsing of bad mount mount point in master map (bz 215620).
- fix use after free memory access in cache.c and lookup_yp.c (bz 208091).
- eliminate use of pthread_kill to detect task completion (bz 208091).
- fix tokenizer to distinguish between global option and dn string (bz 214684).
- fix incorrect return from spawn.


autofs-5.0.1-rc2-fix-catch-global-options.patch:
 CHANGELOG           |    1 +
 lib/master_tok.l    |   15 +++++++++++++++
 modules/parse_sun.c |    6 +++---
 3 files changed, 19 insertions(+), 3 deletions(-)

Index: autofs-5.0.1-rc2-fix-catch-global-options.patch
===================================================================
RCS file: autofs-5.0.1-rc2-fix-catch-global-options.patch
diff -N autofs-5.0.1-rc2-fix-catch-global-options.patch
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ autofs-5.0.1-rc2-fix-catch-global-options.patch	25 Nov 2006 08:52:53 -0000	1.2
@@ -0,0 +1,65 @@
+diff --git a/CHANGELOG b/CHANGELOG
+index ccac516..b11ca75 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -36,6 +36,7 @@
+ - check kernel module version and require 5.00 or above.
+ - fix expire regression introduced in the "mitigate manual umount" patch.
+ - still more on multiply recursive bind mounts.
++- fix tokenizer to distinguish between global option and dn string.
+ 
+ 1/9/2006 autofs-5.0.1 rc2
+ -------------------------
+diff --git a/lib/master_tok.l b/lib/master_tok.l
+index cf90136..71d8c26 100644
+--- a/lib/master_tok.l
++++ b/lib/master_tok.l
+@@ -148,6 +148,13 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
+ 		return(PATH);
+ 	}
+ 
++	{WS}/{DNATTRSTR}= {
++		BEGIN(MAPSTR);
++		*bptr = '\0';
++		strcpy(master_lval.strtype, buff);
++		return(PATH);
++	}
++
+ 	{WS}/"-" {
+ 		BEGIN(OPTSTR);
+ 		*bptr = '\0';
+@@ -156,6 +163,14 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
+ 		return(PATH);
+ 	}
+ 
++	{WS}/{OPTIONSTR} {
++		BEGIN(OPTSTR);
++		*bptr = '\0';
++		strcpy(master_lval.strtype, buff);
++		bptr = buff;
++		return(PATH);
++	}
++
+ 	\\.  { *bptr++ = *(master_text + 1); }
+ 	\"   {
+ 		BEGIN(INITIAL);
+diff --git a/modules/parse_sun.c b/modules/parse_sun.c
+index 9847ea9..6f10a4f 100644
+--- a/modules/parse_sun.c
++++ b/modules/parse_sun.c
+@@ -349,12 +349,12 @@ int parse_init(int argc, const char *con
+ 				return 1;
+ 			}
+ 			ctxt->optstr = noptstr;
+-			debug(LOGOPT_NONE,
+-			      MODPREFIX "init gathered options: %s",
+-			      ctxt->optstr);
+ 		}
+ 	}
+ 
++	debug(LOGOPT_NONE,
++	      MODPREFIX "init gathered global options: %s", ctxt->optstr);
++
+ 	/* We only need this once.  NFS mounts are so common that we cache
+ 	   this module. */
+ 	if (!mount_nfs) {

autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch:
 CHANGELOG      |    1 +
 daemon/spawn.c |    8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

Index: autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch
===================================================================
RCS file: autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch
diff -N autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch	25 Nov 2006 08:52:53 -0000	1.2
@@ -0,0 +1,45 @@
+diff --git a/CHANGELOG b/CHANGELOG
+index b11ca75..5bd1af5 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -37,6 +37,7 @@
+ - fix expire regression introduced in the "mitigate manual umount" patch.
+ - still more on multiply recursive bind mounts.
+ - fix tokenizer to distinguish between global option and dn string.
++- fix incorrect return from spawn (Gordon Lack).
+ 
+ 1/9/2006 autofs-5.0.1 rc2
+ -------------------------
+diff --git a/daemon/spawn.c b/daemon/spawn.c
+index 579c870..2ede231 100644
+--- a/daemon/spawn.c
++++ b/daemon/spawn.c
+@@ -89,7 +89,7 @@ #define ERRBUFSIZ 2047		/* Max length of
+ static int do_spawn(logger *log, unsigned int options, const char *prog, const char *const *argv)
+ {
+ 	pid_t f;
+-	int status, pipefd[2];
++	int ret, status, pipefd[2];
+ 	char errbuf[ERRBUFSIZ + 1], *p, *sp;
+ 	int errp, errn;
+ 	int cancel_state;
+@@ -219,8 +219,8 @@ static int do_spawn(logger *log, unsigne
+ 			log(LOGOPT_ANY, ">> %s", errbuf);
+ 		}
+ 
+-		if (waitpid(f, &status, 0) != f)
+-			status = -1;	/* waitpid() failed */
++		if (waitpid(f, &ret, 0) != f)
++			ret = -1;	/* waitpid() failed */
+ 
+ 		if (use_lock) {
+ 			status = pthread_mutex_unlock(&spawn_mutex);
+@@ -230,7 +230,7 @@ static int do_spawn(logger *log, unsigne
+ 		pthread_sigmask(SIG_SETMASK, &oldsig, NULL);
+ 		pthread_setcancelstate(cancel_state, NULL);
+ 
+-		return status;
++		return ret;
+ 	}
+ }
+ 

autofs-5.0.1-rc2-fix-use-after-free.patch:
 CHANGELOG           |    1 +
 lib/cache.c         |   18 ++++++++++++++++--
 modules/lookup_yp.c |    6 +++++-
 3 files changed, 22 insertions(+), 3 deletions(-)

--- NEW FILE autofs-5.0.1-rc2-fix-use-after-free.patch ---
--- autofs-5.0.1/modules/lookup_yp.c.fix-use-after-free	2006-09-01 13:29:50.000000000 +0800
+++ autofs-5.0.1/modules/lookup_yp.c	2006-11-25 13:27:05.000000000 +0800
@@ -128,8 +128,12 @@ int lookup_init(const char *mapfmt, int 
 	/* This should, but doesn't, take a const char ** */
 	err = yp_get_default_domain((char **) &ctxt->domainname);
 	if (err) {
+		size_t len = strlen(ctxt->mapname);
+		char *name = alloca(len + 1);
+		memcpy(name, ctxt->mapname, len);
+		name[len] = '\0';
 		free(ctxt);
-		debug(LOGOPT_NONE, MODPREFIX "map %s: %s", ctxt->mapname,
+		debug(LOGOPT_NONE, MODPREFIX "map %s: %s", name,
 		       yperr_string(err));
 		return 1;
 	}
--- autofs-5.0.1/lib/cache.c.fix-use-after-free	2006-09-01 13:29:50.000000000 +0800
+++ autofs-5.0.1/lib/cache.c	2006-11-25 13:27:05.000000000 +0800
@@ -351,6 +351,9 @@ struct mapent *cache_lookup(struct mapen
 {
 	struct mapent *me = NULL;
 
+	if (!key)
+		return NULL;
+
 	for (me = mc->hash[hash(key)]; me != NULL; me = me->next) {
 		if (strcmp(key, me->key) == 0)
 			goto done;
@@ -377,6 +380,9 @@ struct mapent *cache_lookup_distinct(str
 {
 	struct mapent *me;
 
+	if (!key)
+		return NULL;
+
 	for (me = mc->hash[hash(key)]; me != NULL; me = me->next) {
 		if (strcmp(key, me->key) == 0)
 			return me;
@@ -659,6 +665,14 @@ int cache_delete(struct mapent_cache *mc
 	struct mapent *me = NULL, *pred;
 	unsigned int hashval = hash(key);
 	int status, ret = CHE_OK;
+	char *this;
+
+	this = alloca(strlen(key) + 1);
+	if (!this) {
+		ret = CHE_FAIL;
+		goto done;
+	}
+	strcpy(this, key);
 
 	me = mc->hash[hashval];
 	if (!me) {
@@ -669,7 +683,7 @@ int cache_delete(struct mapent_cache *mc
 	while (me->next != NULL) {
 		pred = me;
 		me = me->next;
-		if (strcmp(key, me->key) == 0) {
+		if (strcmp(this, me->key) == 0) {
 			if (me->multi && !list_empty(&me->multi_list)) {
 				ret = CHE_FAIL;
 				goto done;
@@ -693,7 +707,7 @@ int cache_delete(struct mapent_cache *mc
 	if (!me)
 		goto done;
 
-	if (strcmp(key, me->key) == 0) {
+	if (strcmp(this, me->key) == 0) {
 		if (me->multi && !list_empty(&me->multi_list)) {
 			ret = CHE_FAIL;
 			goto done;
--- autofs-5.0.1/CHANGELOG.fix-use-after-free	2006-11-25 13:25:17.000000000 +0800
+++ autofs-5.0.1/CHANGELOG	2006-11-25 13:27:05.000000000 +0800
@@ -39,6 +39,7 @@
 - fix tokenizer to distinguish between global option and dn string.
 - fix incorrect return from spawn (Gordon Lack).
 - fix parsing of bad mount mount point in master map.
+- fix use after free memory access in cache.c and lookup_yp.c.
 
 1/9/2006 autofs-5.0.1 rc2
 -------------------------

autofs-5.0.1-rc2-parse-bad-master-map-mountpoint.patch:
 CHANGELOG          |    1 
 lib/master_parse.y |   12 ++------
 lib/master_tok.l   |   75 ++++++++++++++++-------------------------------------
 3 files changed, 28 insertions(+), 60 deletions(-)

--- NEW FILE autofs-5.0.1-rc2-parse-bad-master-map-mountpoint.patch ---
diff --git a/CHANGELOG b/CHANGELOG
index 5bd1af5..eb59699 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -38,6 +38,7 @@
 - still more on multiply recursive bind mounts.
 - fix tokenizer to distinguish between global option and dn string.
 - fix incorrect return from spawn (Gordon Lack).
+- fix parsing of bad mount mount point in master map.
 
 1/9/2006 autofs-5.0.1 rc2
 -------------------------
diff --git a/lib/master_parse.y b/lib/master_parse.y
index 47d9a07..3250d39 100644
--- a/lib/master_parse.y
+++ b/lib/master_parse.y
@@ -127,15 +127,7 @@ #endif
 	} line
 	;
 
-line:	
-	| PATH
-	{
-		path = master_strdup($1);
-		if (!path) {
-			local_free_vars();
-			YYABORT;
-		}
-	}
+line:
 	| PATH map
 	{
 		path = master_strdup($1);
@@ -160,7 +152,9 @@ line:	
 	| PATH OPT_GHOST { master_notify($1); YYABORT; }
 	| PATH OPT_NOGHOST { master_notify($1); YYABORT; }
 	| PATH OPT_VERBOSE { master_notify($1); YYABORT; }
+	| PATH { master_notify($1); YYABORT; }
 	| QUOTE { master_notify($1); YYABORT; }
+	| OPTION { master_notify($1); YYABORT; }
 	| NILL { master_notify($1); YYABORT; }
 	| COMMENT { YYABORT; }
 	;
diff --git a/lib/master_tok.l b/lib/master_tok.l
index 71d8c26..4380d7e 100644
--- a/lib/master_tok.l
+++ b/lib/master_tok.l
@@ -77,6 +77,7 @@ #endif
 
 char buff[1024];
 char *bptr;
+char *optr = buff;
 
 %}
 
@@ -110,27 +111,25 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
 %%
 
 <INITIAL>{
-	{NL} { }
-	{WS} { }
+	{NL} | 
+	\x00 {
+		if (optr != buff) {
+			*optr = '\0';
+			optr = buff;
+			strcpy(master_lval.strtype, buff);
+			return NILL;
+		}
+	}
 
 	#.*  { return COMMENT; }
 
-	"+" {
-		BEGIN(MAPSTR);
-		bptr = buff;
-		yyless(0);
-	}
-
 	"/" {
 		BEGIN(PATHSTR);
 		bptr = buff;
 		yyless(0);
 	}
 
-	"-" {
-		BEGIN(OPTSTR);
-		yyless(0);
-	}
+	.    { *optr++ = *master_text; }
 }
 
 <PATHSTR>{
@@ -141,36 +140,6 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
 		return NILL;
 	}
 
-	{WS}/{INTMAP} {
-		BEGIN(MAPSTR);
-		*bptr = '\0';
-		strcpy(master_lval.strtype, buff);
-		return(PATH);
-	}
-
-	{WS}/{DNATTRSTR}= {
-		BEGIN(MAPSTR);
-		*bptr = '\0';
-		strcpy(master_lval.strtype, buff);
-		return(PATH);
-	}
-
-	{WS}/"-" {
-		BEGIN(OPTSTR);
-		*bptr = '\0';
-		strcpy(master_lval.strtype, buff);
-		bptr = buff;
-		return(PATH);
-	}
-
-	{WS}/{OPTIONSTR} {
-		BEGIN(OPTSTR);
-		*bptr = '\0';
-		strcpy(master_lval.strtype, buff);
-		bptr = buff;
-		return(PATH);
-	}
-
 	\\.  { *bptr++ = *(master_text + 1); }
 	\"   {
 		BEGIN(INITIAL);
@@ -202,7 +171,6 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
 		return PATH;
 	}
 
-
 	.    { *bptr++ = *master_text; }
 }
 
@@ -243,12 +211,6 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
 		yyless(0);
 	}
 
-	"/" {
-		BEGIN(PATHSTR);
-		bptr = buff;
-		yyless(0);
-	}
-
 	{OPTWS}/{NL} {
 		BEGIN(INITIAL);
 		*bptr = '\0';
@@ -268,6 +230,13 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
 	}
 
 	{NL} |
+	\x00 {
+		BEGIN(INITIAL);
+		*bptr = '\0';
+		strcpy(master_lval.strtype, buff);
+		return(MAPNAME);
+	}
+
 	<<EOF>> {
 		BEGIN(INITIAL);
 		*bptr = '\0';
@@ -314,7 +283,9 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
 	{WS}    { BEGIN(OPTSTR); }
 
 	{NL} |
-	<<EOF>>	{ BEGIN(INITIAL); }
+	\x00	{ BEGIN(INITIAL); }
+
+	<<EOF>> { BEGIN(INITIAL); }
 }
 
 <OPTSTR>{
@@ -355,7 +326,9 @@ OPTTOUT		(-t{OPTWS}|-t{OPTWS}={OPTWS}|--
 
 	{WS}	{}
 	{NL} |
-	<<EOF>>	{ BEGIN(INITIAL); }
+	\x00 { BEGIN(INITIAL); }
+
+	<<EOF>> { BEGIN(INITIAL); }
 }
 
 %%

autofs-5.0.1-rc2-use-task-done.patch:
 CHANGELOG      |    1 +
 daemon/state.c |   41 ++++++++++++++++++++++++++++++++---------
 2 files changed, 33 insertions(+), 9 deletions(-)

--- NEW FILE autofs-5.0.1-rc2-use-task-done.patch ---
diff --git a/CHANGELOG b/CHANGELOG
index 4877016..01822f0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -40,6 +40,7 @@
 - fix incorrect return from spawn (Gordon Lack).
 - fix parsing of bad mount mount point in master map.
 - fix use after free memory access in cache.c and lookup_yp.c.
+- eliminate use of pthread_kill to detect task completion.
 
 1/9/2006 autofs-5.0.1 rc2
 -------------------------
diff --git a/daemon/state.c b/daemon/state.c
index ca091ad..948ba88 100644
--- a/daemon/state.c
+++ b/daemon/state.c
@@ -25,6 +25,7 @@ struct state_queue {
 	struct autofs_point *ap;
 	enum states state;
 	unsigned int busy;
+	unsigned int done;
 	unsigned int cancel;
 };
 
@@ -34,6 +35,7 @@ static unsigned int signaled = 0;
 static LIST_HEAD(state_queue);
 
 static void st_set_thid(struct autofs_point *, pthread_t);
+static void st_set_done(struct autofs_point *ap);
 
 #define st_mutex_lock() \
 do { \
@@ -190,6 +192,8 @@ #endif
 
 	state_mutex_unlock(ap);
 
+	st_set_done(ap);
+
 	return;
 }
 
@@ -325,6 +329,8 @@ static void do_readmap_cleanup(void *arg
 
 	state_mutex_unlock(ap);
 
+	st_set_done(ap);
+
 	free(ra);
 
 	return;
@@ -360,10 +366,8 @@ static void *do_readmap(void *arg)
 	status = pthread_cond_signal(&ra->cond);
 	if (status) {
 		error(ap->logopt, "failed to signal expire condition");
-		status = pthread_mutex_unlock(&ra->mutex);
-		if (status)
-			fatal(status);
-		pthread_exit(NULL);
+		pthread_mutex_unlock(&ra->mutex);
+		fatal(status);
 	}
 
 	status = pthread_mutex_unlock(&ra->mutex);
@@ -848,6 +852,27 @@ static void st_set_thid(struct autofs_po
 	return;
 }
 
+static void st_set_done(struct autofs_point *ap)
+{
+	struct list_head *p, *head;
+	struct state_queue *task;
+
+	st_mutex_lock();
+
+	head = &state_queue;
+	list_for_each(p, head) {
+		task = list_entry(p, struct state_queue, list);
+		if (task->ap == ap) {
+			task->done = 1;
+			break;
+		}
+	}
+
+	st_mutex_unlock();
+
+	return;
+}
+
 static void *st_queue_handler(void *arg)
 {
 	struct list_head *head;
@@ -940,11 +965,9 @@ static void *st_queue_handler(void *arg)
 				}
 
 				/* Still busy */
-				if (task->thid) {
-					status = pthread_kill(task->thid, 0);
-					if (status != ESRCH)
-						continue;
-				}
+				if (!task->done)
+					continue;
+
 remove:
 				/* No more tasks for this queue */
 				if (list_empty(&task->pending)) {


Index: autofs.spec
===================================================================
RCS file: /cvs/dist/rpms/autofs/FC-6/autofs.spec,v
retrieving revision 1.156
retrieving revision 1.157
diff -u -r1.156 -r1.157
--- autofs.spec	8 Nov 2006 04:50:17 -0000	1.156
+++ autofs.spec	25 Nov 2006 08:52:53 -0000	1.157
@@ -4,7 +4,7 @@
 Summary: A tool for automatically mounting and unmounting filesystems.
 Name: autofs
 %define version 5.0.1
-%define release 0.rc2.22
+%define release 0.rc2.25
 Version: %{version}
 Release: %{release}
 Epoch: 1
@@ -45,6 +45,11 @@
 Patch31: autofs-5.0.1-rc2-require-kproto-v5.patch
 Patch32: autofs-5.0.1-rc2-fix-manual-umount-regression.patch
 Patch33: autofs-5.0.1-rc2-recursive-bind-mount-use-access-not-opendir.patch
+Patch34: autofs-5.0.1-rc2-fix-catch-global-options.patch
+Patch35: autofs-5.0.1-rc2-fix-incorrect-return-from-spawn.patch
+Patch36: autofs-5.0.1-rc2-parse-bad-master-map-mountpoint.patch
+Patch37: autofs-5.0.1-rc2-fix-use-after-free.patch
+Patch38: autofs-5.0.1-rc2-use-task-done.patch
 Buildroot: /var/tmp/autofs-tmp
 BuildRequires: autoconf, hesiod-devel, openldap-devel, bison, flex, libxml2-devel, cyrus-sasl-devel, openssl-devel
 Prereq: chkconfig
@@ -118,6 +123,11 @@
 %patch31 -p1
 %patch32 -p1
 %patch33 -p1
+%patch34 -p1
+%patch35 -p1
+%patch36 -p1
+%patch37 -p1
+%patch38 -p1
 
 %build
 #CFLAGS="$RPM_OPT_FLAGS" ./configure --prefix=/usr --libdir=%{_libdir}
@@ -174,11 +184,18 @@
 %{_libdir}/autofs/*
 
 %changelog
+* Sat Nov 25 2006 Ian Kent <ikent at redhat.com> - 5.0.1-0.rc2.25
+- fix parsing of bad mount mount point in master map (bz 215620).
+- fix use after free memory access in cache.c and lookup_yp.c (bz 208091).
+- eliminate use of pthread_kill to detect task completion (bz 208091).
+- fix tokenizer to distinguish between global option and dn string (bz 214684).
+- fix incorrect return from spawn.
+
 * Wed Nov 8 2006 Ian Kent <ikent at redhat.com> - 5.0.1-0.rc2.22
 - deal with changed semantics of mkdir in recent kernels.
 - Update patch for changed semantics of mkdir in recent kernels.
-- fix macro table locking.
-- fix nsswitch parser locking.
+- fix macro table locking (bz 208091).
+- fix nsswitch parser locking (bz 208091).
 - allow only one master map read task at a time.
 - fix misc memory leaks.
 - mitigate manual umount of automounts where possible.




More information about the fedora-cvs-commits mailing list