discover/boot: Fix use-after-free in boot()

[petitboot] / discover / boot.c

diff --git a/discover/boot.c b/discover/boot.c
index f9b0223bdf43c42adc30ba439b71ee156eb59a30..e7a72d4330c67d4586912cfb2e2c2994f3095203 100644 (file)
--- a/discover/boot.c
+++ b/discover/boot.c
@@ -11,6 +11,7 @@
 
 #include <log/log.h>
 #include <pb-protocol/pb-protocol.h>
+#include <process/process.h>
 #include <system/system.h>
 #include <talloc/talloc.h>
 #include <url/url.h>
@@ -76,7 +77,7 @@ static int kexec_load(struct boot_task *boot_task)
        *p++ = boot_task->local_image;  /* 6 */
        *p++ = NULL;                    /* 7 */
 
-       result = pb_run_cmd(argv, 1, boot_task->dry_run);
+       result = process_run_simple_argv(boot_task, argv);
 
        if (result)
                pb_log("%s: failed: (%d)\n", __func__, result);
@@ -90,31 +91,18 @@ static int kexec_load(struct boot_task *boot_task)
  * Must only be called after a successful call to kexec_load().
  */
 
-static int kexec_reboot(bool dry_run)
+static int kexec_reboot(struct boot_task *task)
 {
-       int result = 0;
-       const char *argv[4];
-       const char **p;
+       int result;
 
        /* First try running shutdown.  Init scripts should run 'exec -e' */
-
-       p = argv;
-       *p++ = pb_system_apps.shutdown; /* 1 */
-       *p++ =  "-r";                   /* 2 */
-       *p++ =  "now";                  /* 3 */
-       *p++ =  NULL;                   /* 4 */
-
-       result = pb_run_cmd(argv, 1, dry_run);
+       result = process_run_simple(task, pb_system_apps.shutdown, "-r",
+                       "now", NULL);
 
        /* On error, force a kexec with the -e option */
-
        if (result) {
-               p = argv;
-               *p++ = pb_system_apps.kexec;    /* 1 */
-               *p++ = "-e";                    /* 2 */
-               *p++ = NULL;                    /* 3 */
-
-               result = pb_run_cmd(argv, 1, 0);
+               result = process_run_simple(task, pb_system_apps.kexec,
+                                               "-e", NULL);
        }
 
        if (result)
@@ -122,13 +110,8 @@ static int kexec_reboot(bool dry_run)
 
        /* okay, kexec -e -f */
        if (result) {
-               p = argv;
-               *p++ = pb_system_apps.kexec;    /* 1 */
-               *p++ = "-e";                    /* 2 */
-               *p++ = "-f";                    /* 3 */
-               *p++ = NULL;                    /* 4 */
-
-               result = pb_run_cmd(argv, 1, 0);
+               result = process_run_simple(task, pb_system_apps.kexec,
+                                               "-e", "-f", NULL);
        }
 
        if (result)
@@ -244,29 +227,44 @@ static void run_boot_hooks(struct boot_task *task, boot_status_fn status_fn,
 
        for (i = 0; i < n; i++) {
                const char *argv[2] = { NULL, NULL };
-               char *path, *buf;
-               int buf_len, rc;
+               struct process *process;
+               char *path;
+               int rc;
 
                path = join_paths(task, boot_hook_dir, hooks[i]->d_name);
 
-               if (access(path, X_OK))
+               if (access(path, X_OK)) {
+                       talloc_free(path);
                        continue;
+               }
 
-               pb_log("running boot hook %s\n", hooks[i]->d_name);
+               process = process_create(task);
 
                argv[0] = path;
-               rc = pb_run_cmd_pipe(argv, 1, task->dry_run, task,
-                               &buf, &buf_len);
-
-               /* if the hook returned with BOOT_HOOK_EXIT_UPDATE,
-                * then we process stdout to look for updated params
-                */
-               if (rc == BOOT_HOOK_EXIT_UPDATE) {
-                       boot_hook_update(task, hooks[i]->d_name, buf);
-                       boot_hook_setenv(task);
+               process->path = path;
+               process->argv = argv;
+               process->keep_stdout = true;
+
+               pb_log("running boot hook %s\n", hooks[i]->d_name);
+
+               rc = process_run_sync(process);
+               if (rc) {
+                       pb_log("boot hook exec failed!\n");
+
+               } else if (WIFEXITED(process->exit_status) &&
+                          WEXITSTATUS(process->exit_status)
+                               == BOOT_HOOK_EXIT_UPDATE) {
+                       /* if the hook returned with BOOT_HOOK_EXIT_UPDATE,
+                        * then we process stdout to look for updated params
+                        */
+                       if (rc == BOOT_HOOK_EXIT_UPDATE) {
+                               boot_hook_update(task, hooks[i]->d_name,
+                                               process->stdout_buf);
+                               boot_hook_setenv(task);
+                       }
                }
 
-               talloc_free(buf);
+               process_release(process);
                talloc_free(path);
        }
 
@@ -373,13 +371,11 @@ no_load:
        if (clean_dtb)
                unlink(boot_task->local_dtb);
 
-       talloc_free(boot_task);
-
        if (!result) {
                update_status(status_fn, status_arg, BOOT_STATUS_INFO,
                                "performing kexec reboot");
 
-               result = kexec_reboot(boot_task->dry_run);
+               result = kexec_reboot(boot_task);
 
                if (result) {
                        update_status(status_fn, status_arg, BOOT_STATUS_ERROR,
@@ -387,5 +383,7 @@ no_load:
                }
        }
 
+       talloc_free(boot_task);
+
        return result;
 }