- fix return start status on fail.

- fix double free in expire_proc().

autofs-5.0.4-fix-double-free-in-expire_proc.patch

@@ -0,0 +1,38 @@
+autofs-5.0.4 - fix double free in expire_proc()
+
+From: Ian Kent <raven@themaw.net>
+
+In state.c:expire_proc() the function expire_proc_cleanup() is called
+which frees the parameter structure but automount frees this again in
+the following line.
+---
+
+ CHANGELOG      |    1 +
+ daemon/state.c |    1 -
+ 2 files changed, 1 insertions(+), 1 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 2cb35dc..8860b2c 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -28,6 +28,7 @@
+ - add nfs mount protocol default configuration option.
+ - fix bad token declaration in master map parser.
+ - fix return start status on fail.
++- fix double free in expire_proc().
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/daemon/state.c b/daemon/state.c
+index 606743b..417fde1 100644
+--- a/daemon/state.c
++++ b/daemon/state.c
+@@ -298,7 +298,6 @@ static enum expire expire_proc(struct autofs_point *ap, int now)
+ 		error(ap->logopt,
+ 		      "expire thread create for %s failed", ap->path);
+ 		expire_proc_cleanup((void *) ea);
+-		free(ea);
+ 		return EXP_ERROR;
+ 	}
+ 	ap->exp_thread = thid;

autofs-5.0.4-fix-return-start-status-on-fail.patch

@@ -0,0 +1,157 @@
+autofs-5.0.4 - fix return start status on fail
+
+From: Ian Kent <raven@themaw.net>
+
+We're not returning the status to the parent when automount(8) is waiting
+for the daemon to finish its startup.
+---
+
+ CHANGELOG          |    1 +
+ daemon/automount.c |   27 +++++++++++++++++++++------
+ 2 files changed, 22 insertions(+), 6 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index fdde400..2cb35dc 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -27,6 +27,7 @@
+ - add WITH_LIBTIRPC to -V status report.
+ - add nfs mount protocol default configuration option.
+ - fix bad token declaration in master map parser.
++- fix return start status on fail.
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/daemon/automount.c b/daemon/automount.c
+index 776c92c..80691fa 100644
+--- a/daemon/automount.c
++++ b/daemon/automount.c
+@@ -60,7 +60,7 @@ long global_negative_timeout = -1;
+ int do_force_unlink = 0;		/* Forceably unlink mount tree at startup */
+ 
+ static int start_pipefd[2];
+-static int st_stat = 0;
++static int st_stat = 1;
+ static int *pst_stat = &st_stat;
+ static pthread_t state_mach_thid;
+ 
+@@ -1046,6 +1046,7 @@ static void become_daemon(unsigned foreground, unsigned daemon_check)
+ {
+ 	FILE *pidfp;
+ 	char buf[MAX_ERR_BUF];
++	int res;
+ 	pid_t pid;
+ 
+ 	/* Don't BUSY any directories unnecessarily */
+@@ -1072,10 +1073,9 @@ static void become_daemon(unsigned foreground, unsigned daemon_check)
+ 	} else {
+ 		pid = fork();
+ 		if (pid > 0) {
+-			int r;
+ 			close(start_pipefd[1]);
+-			r = read(start_pipefd[0], pst_stat, sizeof(*pst_stat));
+-			if (r < 0)
++			res = read(start_pipefd[0], pst_stat, sizeof(*pst_stat));
++			if (res < 0)
+ 				exit(1);
+ 			exit(*pst_stat);
+ 		} else if (pid < 0) {
+@@ -1088,8 +1088,13 @@ static void become_daemon(unsigned foreground, unsigned daemon_check)
+ 		if (daemon_check && !aquire_flag_file()) {
+ 			fprintf(stderr, "%s: program is already running.\n",
+ 				program);
++			/* Return success if already running */
++			st_stat = 0;
++			res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
++			if (res < 0)
++				exit(1);
+ 			close(start_pipefd[1]);
+-			exit(1);
++			exit(*pst_stat);
+ 		}
+ 
+ 		/*
+@@ -1099,8 +1104,9 @@ static void become_daemon(unsigned foreground, unsigned daemon_check)
+ 		if (setsid() == -1) {
+ 			char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
+ 			fprintf(stderr, "setsid: %s", estr);
++			res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 			close(start_pipefd[1]);
+-			exit(1);
++			exit(*pst_stat);
+ 		}
+ 		log_to_syslog();
+ 	}
+@@ -1991,6 +1997,7 @@ int main(int argc, char *argv[])
+ 	if (!master_list) {
+ 		logerr("%s: can't create master map %s",
+ 			program, argv[0]);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -1999,6 +2006,7 @@ int main(int argc, char *argv[])
+ 	if (pthread_attr_init(&th_attr)) {
+ 		logerr("%s: failed to init thread attribute struct!",
+ 		     program);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -2007,6 +2015,7 @@ int main(int argc, char *argv[])
+ 	if (pthread_attr_init(&th_attr_detached)) {
+ 		logerr("%s: failed to init thread attribute struct!",
+ 		     program);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -2016,6 +2025,7 @@ int main(int argc, char *argv[])
+ 			&th_attr_detached, PTHREAD_CREATE_DETACHED)) {
+ 		logerr("%s: failed to set detached thread attribute!",
+ 		     program);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -2026,6 +2036,7 @@ int main(int argc, char *argv[])
+ 			&th_attr_detached, PTHREAD_STACK_MIN*64)) {
+ 		logerr("%s: failed to set stack size thread attribute!",
+ 		       program);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -2043,6 +2054,7 @@ int main(int argc, char *argv[])
+ 		logerr("%s: failed to create thread data key for std env vars!",
+ 		       program);
+ 		master_kill(master_list);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -2053,6 +2065,7 @@ int main(int argc, char *argv[])
+ 	if (!alarm_start_handler()) {
+ 		logerr("%s: failed to create alarm handler thread!", program);
+ 		master_kill(master_list);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -2061,6 +2074,7 @@ int main(int argc, char *argv[])
+ 	if (!st_start_handler()) {
+ 		logerr("%s: failed to create FSM handler thread!", program);
+ 		master_kill(master_list);
++		res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 		close(start_pipefd[1]);
+ 		release_flag_file();
+ 		exit(1);
+@@ -2092,6 +2106,7 @@ int main(int argc, char *argv[])
+ 	 */
+ 	do_force_unlink = 0;
+ 
++	st_stat = 0;
+ 	res = write(start_pipefd[1], pst_stat, sizeof(*pst_stat));
+ 	close(start_pipefd[1]);
+ 

autofs.spec

@@ -4,7 +4,7 @@
 Summary: A tool for automatically mounting and unmounting filesystems
 Name: autofs
 Version: 5.0.4
-Release: 17
+Release: 18
 Epoch: 1
 License: GPLv2+
 Group: System Environment/Daemons
@@ -37,6 +37,8 @@ Patch24: autofs-5.0.4-libxml2-workaround-fix.patch
 Patch25: autofs-5.0.4-configure-libtirpc-fix.patch
 Patch26: autofs-5.0.4-add-nfs-mount-proto-default-conf-option.patch
 Patch27: autofs-5.0.4-fix-bad-token-declare.patch
+Patch28: autofs-5.0.4-fix-return-start-status-on-fail.patch
+Patch29: autofs-5.0.4-fix-double-free-in-expire_proc.patch
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: autoconf, hesiod-devel, openldap-devel, bison, flex, libxml2-devel, cyrus-sasl-devel, openssl-devel module-init-tools util-linux nfs-utils e2fsprogs libtirpc-devel
 Requires: kernel >= 2.6.17
@@ -105,6 +107,8 @@ echo %{version}-%{release} > .version
 %patch25 -p1
 %patch26 -p1
 %patch27 -p1
+%patch28 -p1
+%patch29 -p1
 
 %build
 #CFLAGS="$RPM_OPT_FLAGS" ./configure --prefix=/usr --libdir=%{_libdir}
@@ -157,6 +161,10 @@ fi
 %{_libdir}/autofs/
 
 %changelog
+* Thu Mar 12 2009 Ian Kent <ikent@redhat.com> - 1:5.0.4-18
+- fix return start status on fail.
+- fix double free in expire_proc().
+
 * Wed Feb 25 2009 Ian Kent <ikent@redhat.com> - 1:5.0.4-17
 - fix bad token declaration in master map parser.