sm-notify command: fix a use-after-free bug

[nfs-utils.git] / utils / statd / sm-notify.c

diff --git a/utils/statd/sm-notify.c b/utils/statd/sm-notify.c
index 8108765cfb9f2bda094b2ae1bbcf312085562650..d58e0be421859ed6c59880e917d53a53a874b877 100644 (file)
--- a/utils/statd/sm-notify.c
+++ b/utils/statd/sm-notify.c
@@ -83,11 +83,11 @@ static void         recv_reply(int);
 static void            backup_hosts(const char *, const char *);
 static void            get_hosts(const char *);
 static void            insert_host(struct nsm_host *);
-struct nsm_host *      find_host(uint32_t);
-void                   nsm_log(int fac, const char *fmt, ...);
+static struct nsm_host *find_host(uint32_t);
+static void            nsm_log(int fac, const char *fmt, ...);
 static int             record_pid(void);
 static void            drop_privs(void);
-static void set_kernel_nsm_state(int state);
+static void            set_kernel_nsm_state(int state);
 
 static struct nsm_host *       hosts = NULL;
 
@@ -131,6 +131,17 @@ static struct addrinfo *smn_lookup(const sa_family_t family, const char *name)
        return ai;
 }
 
+static void smn_forget_host(struct nsm_host *host)
+{
+       unlink(host->path);
+       free(host->path);
+       free(host->name);
+       if (host->ai)
+               freeaddrinfo(host->ai);
+
+       free(host);
+}
+
 int
 main(int argc, char **argv)
 {
@@ -189,10 +200,15 @@ usage:            fprintf(stderr,
                exit(1);
        }
 
+       log_syslog = 1;
+       openlog("sm-notify", LOG_PID, LOG_DAEMON);
+
        if (strcmp(_SM_BASE_PATH, BASEDIR) == 0) {
-               if (record_pid() == 0 && force == 0 && opt_update_state == 1)
+               if (record_pid() == 0 && force == 0 && opt_update_state == 1) {
                        /* already run, don't try again */
+                       nsm_log(LOG_NOTICE, "Already notifying clients; Exiting!");
                        exit(0);
+               }
        }
 
        if (opt_srcaddr) {
@@ -207,6 +223,12 @@ usage:             fprintf(stderr,
        backup_hosts(_SM_DIR_PATH, _SM_BAK_PATH);
        get_hosts(_SM_BAK_PATH);
 
+       /* If there are not hosts to notify, just exit */
+       if (!hosts) {
+               nsm_log(LOG_DEBUG, "No hosts to notify; exiting");
+               return 0;
+       }
+
        /* Get and update the NSM state. This will call sync() */
        nsm_state = nsm_get_state(opt_update_state);
        set_kernel_nsm_state(nsm_state);
@@ -215,9 +237,6 @@ usage:              fprintf(stderr,
                if (!opt_quiet)
                        printf("Backgrounding to notify hosts...\n");
 
-               openlog("sm-notify", LOG_PID, LOG_DAEMON);
-               log_syslog = 1;
-
                if (daemon(0, 0) < 0) {
                        nsm_log(LOG_ERR, "unable to background: %s",
                                        strerror(errno));
@@ -249,7 +268,7 @@ usage:              fprintf(stderr,
 /*
  * Notify hosts
  */
-void
+static void
 notify(void)
 {
        struct sockaddr_storage address;
@@ -332,13 +351,8 @@ notify(void)
                        hp = hosts;
                        hosts = hp->next;
 
-                       if (notify_host(sock, hp)){
-                               unlink(hp->path);
-                               free(hp->name);
-                               free(hp->path);
-                               free(hp);
+                       if (notify_host(sock, hp))
                                continue;
-                       }
 
                        /* Set the timeout for this call, using an
                           exponential timeout strategy */
@@ -372,7 +386,7 @@ notify(void)
 /*
  * Send notification to a single host
  */
-int
+static int
 notify_host(int sock, struct nsm_host *host)
 {
        struct sockaddr_storage address;
@@ -393,6 +407,7 @@ notify_host(int sock, struct nsm_host *host)
                        nsm_log(LOG_WARNING,
                                "%s doesn't seem to be a valid address,"
                                " skipped", host->name);
+                       smn_forget_host(host);
                        return 1;
                }
        }
@@ -475,7 +490,7 @@ notify_host(int sock, struct nsm_host *host)
 /*
  * Receive reply from remote host
  */
-void
+static void
 recv_reply(int sock)
 {
        struct nsm_host *hp;
@@ -537,11 +552,7 @@ recv_reply(int sock)
                if (p <= end) {
                        nsm_log(LOG_DEBUG, "Host %s notified successfully",
                                        hp->name);
-                       unlink(hp->path);
-                       free(hp->name);
-                       free(hp->path);
-                       free(hp);
-                       freeaddrinfo(hp->ai);
+                       smn_forget_host(hp);
                        return;
                }
        }
@@ -634,7 +645,7 @@ get_hosts(const char *dirname)
 /*
  * Insert host into sorted list
  */
-void
+static void
 insert_host(struct nsm_host *host)
 {
        struct nsm_host **where, *p;
@@ -662,7 +673,7 @@ insert_host(struct nsm_host *host)
 /*
  * Find host given the XID
  */
-struct nsm_host *
+static struct nsm_host *
 find_host(uint32_t xid)
 {
        struct nsm_host **where, *p;
@@ -682,7 +693,7 @@ find_host(uint32_t xid)
 /*
  * Retrieve the current NSM state
  */
-unsigned int
+static unsigned int
 nsm_get_state(int update)
 {
        char            newfile[PATH_MAX];
@@ -738,7 +749,7 @@ nsm_get_state(int update)
 /*
  * Log a message
  */
-void
+static void
 nsm_log(int fac, const char *fmt, ...)
 {
        va_list ap;