util:bind_remount_recursive() fix "use after free"

set_consume(done, x) consumes x with free(x)
but
mount(…, x, …) uses it afterwards.

coverity CID 1299006

diff --git a/src/shared/util.c b/src/shared/util.c
index 311acbb..1442301 100644 (file)
--- a/src/shared/util.c
+++ b/src/shared/util.c
@@ -4931,11 +4931,15 @@ int bind_remount_recursive(const char *prefix, bool ro) {
 
                 while ((x = set_steal_first(todo))) {
 
-                        r = set_consume(done, x);
-                        if (r == -EEXIST)
+                        r = set_put(done, x);
+                        if (r == -EEXIST) {
+                                free(x);
                                 continue;
-                        if (r < 0)
+                        }
+                        if (r < 0) {
+                                free(x);
                                 return r;
+                        }
 
                         /* Try to reuse the original flag set, but
                          * don't care for errors, in case of
@@ -4945,14 +4949,15 @@ int bind_remount_recursive(const char *prefix, bool ro) {
                         orig_flags &= ~MS_RDONLY;
 
                         if (mount(NULL, x, NULL, orig_flags|MS_BIND|MS_REMOUNT|(ro ? MS_RDONLY : 0), NULL) < 0) {
-
                                 /* Deal with mount points that are
                                  * obstructed by a later mount */
 
-                                if (errno != ENOENT)
+                                if (errno != ENOENT) {
+                                        free(x);
                                         return -errno;
+                                }
                         }
-
+                        free(x);
                 }
         }
 }