|
 |
62fe945 |
From d974ad0524942882f489914013d08ab16d147170 Mon Sep 17 00:00:00 2001
|
|
|
62fe945 |
From: David Herrmann <dh.herrmann@gmail.com>
|
|
|
62fe945 |
Date: Thu, 28 Aug 2014 12:42:03 +0200
|
|
|
62fe945 |
Subject: [PATCH] bus: fix use-after-free in slot-release
|
|
|
62fe945 |
|
|
|
62fe945 |
We must not access slot->floating after we possible dropped the last
|
|
|
62fe945 |
reference to it. Fix all callback-invocations to first check
|
|
|
62fe945 |
slot->floating and possible disconnect the slot, then release the last
|
|
|
62fe945 |
reference.
|
|
|
62fe945 |
---
|
|
|
62fe945 |
src/libsystemd/sd-bus/sd-bus.c | 12 +++++++++---
|
|
|
62fe945 |
1 file changed, 9 insertions(+), 3 deletions(-)
|
|
|
62fe945 |
|
|
|
62fe945 |
diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
|
|
|
62fe945 |
index a204d67590..8caa404227 100644
|
|
|
62fe945 |
--- a/src/libsystemd/sd-bus/sd-bus.c
|
|
|
62fe945 |
+++ b/src/libsystemd/sd-bus/sd-bus.c
|
|
|
62fe945 |
@@ -2107,7 +2107,7 @@ static int process_timeout(sd_bus *bus) {
|
|
|
62fe945 |
r = c->callback(bus, m, slot->userdata, &error_buffer);
|
|
|
62fe945 |
bus->current_userdata = NULL;
|
|
|
62fe945 |
bus->current_handler = NULL;
|
|
|
62fe945 |
- bus->current_slot = sd_bus_slot_unref(slot);
|
|
|
62fe945 |
+ bus->current_slot = NULL;
|
|
|
62fe945 |
bus->current_message = NULL;
|
|
|
62fe945 |
|
|
|
62fe945 |
if (slot->floating) {
|
|
|
62fe945 |
@@ -2115,6 +2115,8 @@ static int process_timeout(sd_bus *bus) {
|
|
|
62fe945 |
sd_bus_slot_unref(slot);
|
|
|
62fe945 |
}
|
|
|
62fe945 |
|
|
|
62fe945 |
+ sd_bus_slot_unref(slot);
|
|
|
62fe945 |
+
|
|
|
62fe945 |
return bus_maybe_reply_error(m, r, &error_buffer);
|
|
|
62fe945 |
}
|
|
|
62fe945 |
|
|
|
62fe945 |
@@ -2203,13 +2205,15 @@ static int process_reply(sd_bus *bus, sd_bus_message *m) {
|
|
|
62fe945 |
r = c->callback(bus, m, slot->userdata, &error_buffer);
|
|
|
62fe945 |
bus->current_userdata = NULL;
|
|
|
62fe945 |
bus->current_handler = NULL;
|
|
|
62fe945 |
- bus->current_slot = sd_bus_slot_unref(slot);
|
|
|
62fe945 |
+ bus->current_slot = NULL;
|
|
|
62fe945 |
|
|
|
62fe945 |
if (slot->floating) {
|
|
|
62fe945 |
bus_slot_disconnect(slot);
|
|
|
62fe945 |
sd_bus_slot_unref(slot);
|
|
|
62fe945 |
}
|
|
|
62fe945 |
|
|
|
62fe945 |
+ sd_bus_slot_unref(slot);
|
|
|
62fe945 |
+
|
|
|
62fe945 |
return bus_maybe_reply_error(m, r, &error_buffer);
|
|
|
62fe945 |
}
|
|
|
62fe945 |
|
|
|
62fe945 |
@@ -2529,7 +2533,7 @@ static int process_closing(sd_bus *bus, sd_bus_message **ret) {
|
|
|
62fe945 |
r = c->callback(bus, m, slot->userdata, &error_buffer);
|
|
|
62fe945 |
bus->current_userdata = NULL;
|
|
|
62fe945 |
bus->current_handler = NULL;
|
|
|
62fe945 |
- bus->current_slot = sd_bus_slot_unref(slot);
|
|
|
62fe945 |
+ bus->current_slot = NULL;
|
|
|
62fe945 |
bus->current_message = NULL;
|
|
|
62fe945 |
|
|
|
62fe945 |
if (slot->floating) {
|
|
|
62fe945 |
@@ -2537,6 +2541,8 @@ static int process_closing(sd_bus *bus, sd_bus_message **ret) {
|
|
|
62fe945 |
sd_bus_slot_unref(slot);
|
|
|
62fe945 |
}
|
|
|
62fe945 |
|
|
|
62fe945 |
+ sd_bus_slot_unref(slot);
|
|
|
62fe945 |
+
|
|
|
62fe945 |
return bus_maybe_reply_error(m, r, &error_buffer);
|
|
|
62fe945 |
}
|
|
|
62fe945 |
|