[PATCH] mount.cifs: Fix double-free issue when mounting with setuid root

* [PATCH] mount.cifs: Fix double-free issue when mounting with setuid root
@ 2019-09-05 18:49 Paulo Alcantara (SUSE)
  2019-09-09 12:46 ` Aurélien Aptel
  0 siblings, 1 reply; 3+ messages in thread
From: Paulo Alcantara (SUSE) @ 2019-09-05 18:49 UTC (permalink / raw)
  To: linux-cifs, samba-technical, piastryyy; +Cc: aaptel, Paulo Alcantara (SUSE)

It can be easily reproduced with the following:

  # chmod +s `which mount.cifs`
  # echo "//localhost/share /mnt cifs \
    users,username=foo,password=XXXX" >> /etc/fstab
  # su - foo
  $ mount /mnt
  free(): double free detected in tcache 2
  Child process terminated abnormally.

The problem was that check_fstab() already freed orgoptions pointer
and then we freed it again in main() function.

Fixes: bf7f48f4c7dc ("mount.cifs.c: fix memory leaks in main func")
Signed-off-by: Paulo Alcantara (SUSE) <paulo@paulo.ac>
---
 mount.cifs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mount.cifs.c b/mount.cifs.c
index 7748d54aa814..2116fc803311 100644
--- a/mount.cifs.c
+++ b/mount.cifs.c
@@ -247,7 +247,6 @@ check_fstab(const char *progname, const char *mountpoint, const char *devname,
 	 * set of options. We don't want to trust what the user
 	 * gave us, so just take whatever is in /etc/fstab.
 	 */
-	free(*options);
 	*options = strdup(mnt->mnt_opts);
 	return 0;
 }
@@ -1762,6 +1761,7 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info,
 		   const char *orig_dev, char *orgoptions)
 {
 	int rc;
+	char *newopts = NULL;
 
 	rc = drop_capabilities(0);
 	if (rc)
@@ -1773,10 +1773,11 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info,
 
 	if (getuid()) {
 		rc = check_fstab(thisprogram, mountpoint, orig_dev,
-				 &orgoptions);
+				 &newopts);
 		if (rc)
 			goto assemble_exit;
 
+		orgoptions = newopts;
 		/* enable any default user mount flags */
 		parsed_info->flags |= CIFS_SETUID_FLAGS;
 	}
@@ -1880,6 +1881,7 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info,
 	}
 
 assemble_exit:
+	free(newopts);
 	return rc;
 }
 
-- 
2.23.0


^ permalink raw reply related	[flat|nested] 3+ messages in thread