Merge pull request #2221 from tych0/fix-use-after-free

fix handler use-after-free
This commit is contained in:
Christian Brauner 2018-03-15 16:52:39 +01:00 committed by GitHub
commit 0e83121caa
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 13 additions and 11 deletions

View File

@ -120,7 +120,7 @@ static struct lxc_operations execute_start_ops = {
int lxc_execute(const char *name, char *const argv[], int quiet,
struct lxc_handler *handler, const char *lxcpath,
bool backgrounded)
bool backgrounded, int *error_num)
{
struct execute_args args = {.argv = argv, .quiet = quiet};
@ -129,5 +129,5 @@ int lxc_execute(const char *name, char *const argv[], int quiet,
handler->conf->is_execute = 1;
return __lxc_start(name, handler, &execute_start_ops, &args, lxcpath,
backgrounded);
backgrounded, error_num);
}

View File

@ -54,7 +54,7 @@ struct lxc_handler;
*/
extern int lxc_start(const char *name, char *const argv[],
struct lxc_handler *handler, const char *lxcpath,
bool backgrounded);
bool backgrounded, int *error_num);
/*
* Start the specified command inside an application container
@ -67,7 +67,7 @@ extern int lxc_start(const char *name, char *const argv[],
*/
extern int lxc_execute(const char *name, char *const argv[], int quiet,
struct lxc_handler *handler, const char *lxcpath,
bool backgrounded);
bool backgrounded, int *error_num);
/*
* Close the fd associated with the monitoring

View File

@ -1066,10 +1066,9 @@ reboot:
}
if (useinit)
ret = lxc_execute(c->name, argv, 1, handler, c->config_path, daemonize);
ret = lxc_execute(c->name, argv, 1, handler, c->config_path, daemonize, &c->error_num);
else
ret = lxc_start(c->name, argv, handler, c->config_path, daemonize);
c->error_num = handler->exit_status;
ret = lxc_start(c->name, argv, handler, c->config_path, daemonize, &c->error_num);
if (conf->reboot == 1) {
INFO("Container requested reboot");

View File

@ -1824,7 +1824,7 @@ out_abort:
int __lxc_start(const char *name, struct lxc_handler *handler,
struct lxc_operations* ops, void *data, const char *lxcpath,
bool backgrounded)
bool backgrounded, int *error_num)
{
int ret, status;
struct lxc_conf *conf = handler->conf;
@ -1920,6 +1920,8 @@ int __lxc_start(const char *name, struct lxc_handler *handler,
lxc_monitor_send_exit_code(name, status, handler->lxcpath);
lxc_error_set_and_log(handler->pid, status);
if (error_num)
*error_num = handler->exit_status;
out_fini:
lxc_delete_network(handler);
@ -1965,13 +1967,13 @@ static struct lxc_operations start_ops = {
};
int lxc_start(const char *name, char *const argv[], struct lxc_handler *handler,
const char *lxcpath, bool backgrounded)
const char *lxcpath, bool backgrounded, int *error_num)
{
struct start_args start_arg = {
.argv = argv,
};
return __lxc_start(name, handler, &start_ops, &start_arg, lxcpath, backgrounded);
return __lxc_start(name, handler, &start_ops, &start_arg, lxcpath, backgrounded, error_num);
}
static void lxc_destroy_container_on_signal(struct lxc_handler *handler,

View File

@ -165,7 +165,8 @@ extern void lxc_fini(const char *name, struct lxc_handler *handler);
extern int lxc_check_inherited(struct lxc_conf *conf, bool closeall,
int *fds_to_ignore, size_t len_fds);
extern int __lxc_start(const char *, struct lxc_handler *,
struct lxc_operations *, void *, const char *, bool);
struct lxc_operations *, void *, const char *, bool,
int *);
extern int resolve_clone_flags(struct lxc_handler *handler);