lxcfs
/
0007-set-null-after-free.patch

diff --git a/src/cgroup_fuse.c b/src/cgroup_fuse.c
index d4bdac1..76507f1 100644
--- a/src/cgroup_fuse.c
+++ b/src/cgroup_fuse.c
@@ -187,7 +187,7 @@ static bool is_child_cgroup(const char *controller, const char *cgroup,
 static bool caller_may_see_dir(pid_t pid, const char *contrl, const char *cg)
 {
 	bool answer = false;
-	char *c2, *task_cg;
+	char *c2 = NULL, *task_cg = NULL;
 	size_t target_len, task_len;

 	if (strcmp(cg, "/") == 0 || strcmp(cg, "./") == 0)
@@ -229,6 +229,7 @@ static bool caller_may_see_dir(pid_t pid, const char *contrl, const char *cg)

 out:
 	free(c2);
+	c2 = NULL;
 	return answer;
 }

@@ -268,8 +269,8 @@ static char *get_next_cgroup_dir(const char *taskcg, const char *querycg)
 static bool caller_is_in_ancestor(pid_t pid, const char *contrl, const char *cg, char **nextcg)
 {
 	bool answer = false;
-	char *c2;
-	char *linecmp;
+	char *c2 = NULL;
+	char *linecmp = NULL;

 	c2 = get_pid_cgroup_handle_named(pid, contrl);
 	if (!c2)
@@ -299,6 +300,7 @@ static bool caller_is_in_ancestor(pid_t pid, const char *contrl, const char *cg,

 out:
 	free(c2);
+	c2 = NULL;
 	return answer;
 }

@@ -618,6 +620,7 @@ __lxcfs_fuse_ops int cg_getattr(const char *path, struct stat *sb)

 out:
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }

@@ -740,7 +743,9 @@ __lxcfs_fuse_ops int cg_mkdir(const char *path, mode_t mode)

 out:
 	free(cgdir);
+	cgdir = NULL;
 	free(next);
+	next = NULL;
 	return ret;
 }

@@ -875,7 +880,9 @@ __lxcfs_fuse_ops int cg_rmdir(const char *path)

 out:
 	free(cgdir);
+	cgdir = NULL;
 	free(next);
+	next = NULL;
 	return ret;
 }

@@ -964,6 +971,7 @@ __lxcfs_fuse_ops int cg_chmod(const char *path, mode_t mode)
 out:
 	free_key(k);
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }

@@ -1073,6 +1081,7 @@ __lxcfs_fuse_ops int cg_chown(const char *path, uid_t uid, gid_t gid)
 out:
 	free_key(k);
 	free(cgdir);
+	cgdir = NULL;

 	return ret;
 }
@@ -1145,6 +1154,7 @@ __lxcfs_fuse_ops int cg_open(const char *path, struct fuse_file_info *fi)

 out:
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }

@@ -1286,6 +1296,7 @@ static bool do_read_pids(pid_t tpid, const char *contrl, const char *cg,
 	if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sock) < 0) {
 		perror("socketpair");
 		free(tmpdata);
+		tmpdata = NULL;
 		return false;
 	}

@@ -1337,6 +1348,7 @@ next:

 out:
 	free(tmpdata);
+	tmpdata = NULL;
 	if (cpid != -1)
 		wait_for_pid(cpid);
 	if (sock[0] != -1) {
@@ -1413,6 +1425,7 @@ __lxcfs_fuse_ops int cg_read(const char *path, char *buf, size_t size,

 out:
 	free(data);
+	data = NULL;
 	return ret;
 }

@@ -1989,6 +2002,7 @@ __lxcfs_fuse_ops int cg_readdir(const char *path, void *buf,
 		if (nextcg) {
 			ret = filler(buf, nextcg,  NULL, 0);
 			free(nextcg);
+			nextcg = NULL;
 			if (ret != 0) {
 				ret = -EIO;
 				goto out;
@@ -2024,9 +2038,12 @@ __lxcfs_fuse_ops int cg_readdir(const char *path, void *buf,
 out:
 	free_keys(list);
 	if (clist) {
-		for (i = 0; clist[i]; i++)
+		for (i = 0; clist[i]; i++) {
 			free(clist[i]);
+			clist[i] = NULL;
+		}
 		free(clist);
+		clist = NULL;
 	}
 	return ret;
 }
@@ -2095,5 +2112,6 @@ __lxcfs_fuse_ops int cg_access(const char *path, int mode)

 out:
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }
diff --git a/src/cgroups/cgfsng.c b/src/cgroups/cgfsng.c
index cf891b3..ca80a75 100644
--- a/src/cgroups/cgfsng.c
+++ b/src/cgroups/cgfsng.c
@@ -878,7 +878,7 @@ static int cg_hybrid_init(struct cgroup_ops *ops)
 		prune_init_scope(base_cgroup);

 		if (type == CGROUP2_SUPER_MAGIC) {
-			char *cgv2_ctrl_path;
+			char *cgv2_ctrl_path = NULL;

 			cgv2_ctrl_path = must_make_path(mountpoint, base_cgroup,
 							"cgroup.controllers",
@@ -886,6 +886,7 @@ static int cg_hybrid_init(struct cgroup_ops *ops)

 			controller_list = cg_unified_get_controllers(cgv2_ctrl_path);
 			free(cgv2_ctrl_path);
+			cgv2_ctrl_path = NULL;
 			if (!controller_list)
 				controller_list = cg_unified_make_empty_controller();
 		}
@@ -900,7 +901,9 @@ static int cg_hybrid_init(struct cgroup_ops *ops)
 	next:
 		free_string_list(controller_list);
 		free(mountpoint);
+		mountpoint = NULL;
 		free(base_cgroup);
+		base_cgroup = NULL;
 	}

 	free_string_list(klist);
diff --git a/src/cgroups/cgroup_utils.c b/src/cgroups/cgroup_utils.c
index c21e7bc..521ec8b 100644
--- a/src/cgroups/cgroup_utils.c
+++ b/src/cgroups/cgroup_utils.c
@@ -710,7 +710,7 @@ bool mkdir_p(const char *dir, mode_t mode)
 {
 	const char *tmp = dir;
 	const char *orig = dir;
-	char *makeme;
+	char *makeme = NULL;

 	do {
 		dir = tmp + strspn(tmp, "/");
@@ -722,9 +722,11 @@ bool mkdir_p(const char *dir, mode_t mode)
 			lxcfs_error("Failed to create directory '%s': %s.\n",
 				makeme, strerror(errno));
 			free(makeme);
+			makeme = NULL;
 			return false;
 		}
 		free(makeme);
+		makeme = NULL;
 	} while(tmp != dir);

 	return true;
diff --git a/src/lxcfs.c b/src/lxcfs.c
index 94256d4..2251a20 100644
--- a/src/lxcfs.c
+++ b/src/lxcfs.c
@@ -1130,6 +1130,7 @@ int main(int argc, char *argv[])
 			} else {
 				lxcfs_error("Warning: unexpected fuse option %s", v);
 				free(v);
+				v = NULL;
 				exit(EXIT_FAILURE);
 			}
 		}
diff --git a/src/memory_utils.h b/src/memory_utils.h
index 2916f56..c903d48 100644
--- a/src/memory_utils.h
+++ b/src/memory_utils.h
@@ -65,8 +65,10 @@ static inline void free_disarm_function(void *ptr)
 static inline void free_string_list(char **list)
 {
 	if (list) {
-		for (int i = 0; list[i]; i++)
+		for (int i = 0; list[i]; i++) {
 			free(list[i]);
+			list[i] = NULL;
+		}
 		free_disarm(list);
 	}
 }
diff --git a/src/proc_loadavg.c b/src/proc_loadavg.c
index 7a7a39e..84787a9 100644
--- a/src/proc_loadavg.c
+++ b/src/proc_loadavg.c
@@ -445,10 +445,13 @@ static int refresh_load(struct load_node *p, const char *path)
 	p->last_pid	= last_pid;

 err_out:
-	for (; i > 0; i--)
+	for (; i > 0; i--) {
 		free(idbuf[i - 1]);
+		idbuf[i - 1] = NULL;
+	}
 out:
 	free(idbuf);
+	idbuf = NULL;
 	return sum;
 }