xfs_healer: fix getmntent race in weakhandle

Codex points out that getmntent() can't be used in threaded programs
because it might employ hidden global static buffers.  GNU and musl libc
provide a getmntent_r variant that requires the caller to establish the
buffers, so let's use that.

Cc: linux-xfs@vger.kernel.org # v7.0.0
Fixes: 54c0ba68b007b3 ("xfs_healer: use getmntent to find moved filesystems")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/healer/weakhandle.c b/healer/weakhandle.c
index 9aa8859881481ba1d20987910e74bbbb09293b67..0601011d167cd9341829322f5487d4a92615c6da 100644 (file)
--- a/healer/weakhandle.c
+++ b/healer/weakhandle.c
@@ -155,6 +155,9 @@ out_mntfd:
        return -1;
 }
 
+/* three paths, a filesystem type string of unknown length, and options */
+#define MNTENT_BUFLEN          (4 * PATH_MAX + NAME_MAX)
+
 /* Reopen a file handle obtained via weak reference. */
 int
 weakhandle_reopen(
@@ -163,11 +166,13 @@ weakhandle_reopen(
        weakhandle_fd_t         is_acceptable,
        void                    *data)
 {
+       struct mntent           ent;
        const size_t            smbuf_size =
                libfrog_statmount_sizeof(PATH_MAX);
        struct statmount        *smbuf = alloca(smbuf_size);
        FILE                    *mtab;
        struct mntent           *mnt;
+       char                    *buf;
        int                     ret;
 
        /* First try reopening using the original mountpoint */
@@ -203,7 +208,13 @@ fallback:
        if (!mtab)
                return -1;
 
-       while ((mnt = getmntent(mtab)) != NULL) {
+       buf = malloc(MNTENT_BUFLEN);
+       if (!buf) {
+               ret = -1;
+               goto out_mtab;
+       }
+
+       while ((mnt = getmntent_r(mtab, &ent, buf, MNTENT_BUFLEN)) != NULL) {
                if (strcmp(mnt->mnt_type, "xfs"))
                        continue;
                if (strcmp(mnt->mnt_fsname, wh->fsname))
@@ -222,6 +233,8 @@ fallback:
                ret = -1;
        }
 
+       free(buf);
+out_mtab:
        endmntent(mtab);
        return ret;
 }