Skip to content

Commit

Permalink
tmpfiles: avoid null free() for acl attributes
Browse files Browse the repository at this point in the history
When built with ACL support, we might be processing a tmpfiles
entry where there's no cause for us to call parse_acls_from_arg,
then we get to the end of parse_line without having ever populated
i.{acl_access, acl_default}.

Then we pass a null pointer into acl_free().

From UBSAN w/ GCC 13.0.0_pre20230101:
```
$ systemd-tmpfiles --clean
/var/tmp/portage/sys-apps/acl-2.3.1-r1/work/acl-2.3.1/libacl/acl_free.c:44:14: runtime error: applying non-zero offset 18446744073709551608 to null pointer
    #0 0x7f65d868b482 in acl_free /var/tmp/portage/sys-apps/acl-2.3.1-r1/work/acl-2.3.1/libacl/acl_free.c:44
    systemd#1 0x55fe7e592249 in item_free_contents ../systemd-9999/src/tmpfiles/tmpfiles.c:2855
    systemd#2 0x55fe7e5a347a in parse_line ../systemd-9999/src/tmpfiles/tmpfiles.c:3158
    systemd#3 0x55fe7e5a347a in read_config_file ../systemd-9999/src/tmpfiles/tmpfiles.c:3897
    systemd#4 0x55fe7e590c61 in read_config_files ../systemd-9999/src/tmpfiles/tmpfiles.c:3985
    systemd#5 0x55fe7e590c61 in run ../systemd-9999/src/tmpfiles/tmpfiles.c:4157
    systemd#6 0x55fe7e590c61 in main ../systemd-9999/src/tmpfiles/tmpfiles.c:4218
    systemd#7 0x7f65d7ebe289  (/usr/lib64/libc.so.6+0x23289)
    systemd#8 0x7f65d7ebe344 in __libc_start_main (/usr/lib64/libc.so.6+0x23344)
    systemd#9 0x55fe7e591900 in _start (/usr/bin/systemd-tmpfiles+0x11900)
```

(cherry picked from commit 9f804ab)
  • Loading branch information
thesamesam authored and bluca committed Jan 25, 2023
1 parent 3b6bb62 commit 53f5ef8
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions src/tmpfiles/tmpfiles.c
Original file line number Diff line number Diff line change
Expand Up @@ -2849,8 +2849,11 @@ static void item_free_contents(Item *i) {
strv_free(i->xattrs);

#if HAVE_ACL
acl_free(i->acl_access);
acl_free(i->acl_default);
if (i->acl_access)
acl_free(i->acl_access);

if (i->acl_default)
acl_free(i->acl_default);
#endif
}

Expand Down

0 comments on commit 53f5ef8

Please sign in to comment.