Skip to content

Commit 9f804ab

Browse files
thesamesampoettering
authored andcommitted
tmpfiles: avoid null free() for acl attributes
When built with ACL support, we might be processing a tmpfiles entry where there's no cause for us to call parse_acls_from_arg, then we get to the end of parse_line without having ever populated i.{acl_access, acl_default}. Then we pass a null pointer into acl_free(). From UBSAN w/ GCC 13.0.0_pre20230101: ``` $ systemd-tmpfiles --clean /var/tmp/portage/sys-apps/acl-2.3.1-r1/work/acl-2.3.1/libacl/acl_free.c:44:14: runtime error: applying non-zero offset 18446744073709551608 to null pointer #0 0x7f65d868b482 in acl_free /var/tmp/portage/sys-apps/acl-2.3.1-r1/work/acl-2.3.1/libacl/acl_free.c:44 #1 0x55fe7e592249 in item_free_contents ../systemd-9999/src/tmpfiles/tmpfiles.c:2855 #2 0x55fe7e5a347a in parse_line ../systemd-9999/src/tmpfiles/tmpfiles.c:3158 #3 0x55fe7e5a347a in read_config_file ../systemd-9999/src/tmpfiles/tmpfiles.c:3897 #4 0x55fe7e590c61 in read_config_files ../systemd-9999/src/tmpfiles/tmpfiles.c:3985 #5 0x55fe7e590c61 in run ../systemd-9999/src/tmpfiles/tmpfiles.c:4157 #6 0x55fe7e590c61 in main ../systemd-9999/src/tmpfiles/tmpfiles.c:4218 #7 0x7f65d7ebe289 (/usr/lib64/libc.so.6+0x23289) #8 0x7f65d7ebe344 in __libc_start_main (/usr/lib64/libc.so.6+0x23344) #9 0x55fe7e591900 in _start (/usr/bin/systemd-tmpfiles+0x11900) ```
1 parent 5780333 commit 9f804ab

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

src/tmpfiles/tmpfiles.c

+5-2
Original file line numberDiff line numberDiff line change
@@ -2852,8 +2852,11 @@ static void item_free_contents(Item *i) {
28522852
strv_free(i->xattrs);
28532853

28542854
#if HAVE_ACL
2855-
acl_free(i->acl_access);
2856-
acl_free(i->acl_default);
2855+
if (i->acl_access)
2856+
acl_free(i->acl_access);
2857+
2858+
if (i->acl_default)
2859+
acl_free(i->acl_default);
28572860
#endif
28582861
}
28592862

0 commit comments

Comments
 (0)