- fix incorrect dclist free.

- srv lookup handle endianness.
- fix bug introduced by library reload changes which causes autofs to not
    release mount thread resources when using submounts.
- fix notify mount message path.
- try harder to work out if we created mount point at remount.
- fix double free in do_sasl_bind().
- manual umount recovery fixes.
- fix map type info parse error.

autofs-5.0.4-fix-double-free-in-do_sasl_bind.patch

@@ -0,0 +1,42 @@
+autofs-5.0.4 - fix double free in do_sasl_bind()
+
+From: Ian Kent <raven@themaw.net>
+
+In do_sasl_bind() the connection negotiation loop can exit with the
+local variable server_cred non-null after it has been freed, leading
+to a double free.
+---
+
+ CHANGELOG            |    1 +
+ modules/cyrus-sasl.c |    4 +++-
+ 2 files changed, 4 insertions(+), 1 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index e138ca3..f0d0e58 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -53,6 +53,7 @@
+ - fix not releasing resources when using submounts.
+ - fix notify mount message path.
+ - remount we created mount point fix.
++- fix double free in sasl_bind().
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/modules/cyrus-sasl.c b/modules/cyrus-sasl.c
+index ec2ab0c..04001d0 100644
+--- a/modules/cyrus-sasl.c
++++ b/modules/cyrus-sasl.c
+@@ -348,8 +348,10 @@ do_sasl_bind(unsigned logopt, LDAP *ld, sasl_conn_t *conn, const char **clientou
+ 			}
+ 		}
+ 
+-		if (server_cred && server_cred->bv_len > 0)
++		if (server_cred && server_cred->bv_len > 0) {
+ 			ber_bvfree(server_cred);
++			server_cred = NULL;
++		}
+ 
+ 	} while ((bind_result == LDAP_SASL_BIND_IN_PROGRESS) ||
+ 		 (sasl_result == SASL_CONTINUE));

autofs-5.0.4-fix-incorrect-dclist-free.patch

@@ -0,0 +1,39 @@
+autofs-5.0.4 - fix incorrect dclist free
+
+From: Ian Kent <raven@themaw.net>
+
+We incorrectly try to free dclist in modules/lookup_ldap.c:find_server().
+---
+
+ modules/lookup_ldap.c |   10 ++++++++--
+ 1 files changed, 8 insertions(+), 2 deletions(-)
+
+
+diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c
+index f6b3f42..8f352d6 100644
+--- a/modules/lookup_ldap.c
++++ b/modules/lookup_ldap.c
+@@ -688,6 +688,10 @@ static LDAP *find_server(unsigned logopt, struct lookup_context *ctxt)
+ 			}
+ 		}
+ 		if (!uri) {
++			if (dclist) {
++				free_dclist(dclist);
++				dclist = NULL;
++			}
+ 			p = p->next;
+ 			continue;
+ 		}
+@@ -700,8 +704,10 @@ static LDAP *find_server(unsigned logopt, struct lookup_context *ctxt)
+ 		}
+ 		free(uri);
+ 		uri = NULL;
+-		free_dclist(dclist);
+-		dclist = NULL;
++		if (dclist) {
++			free_dclist(dclist);
++			dclist = NULL;
++		}
+ 		p = p->next;
+ 	}
+ 

autofs-5.0.4-fix-map-type-info-parse-error.patch

@@ -0,0 +1,51 @@
+autofs-5.0.4 - fix map type info parse error
+
+From: Ian Kent <raven@themaw.net>
+
+Fix a mistake in map type info parsing introduced by the IPv6 parse
+changes.
+---
+
+ CHANGELOG        |    1 +
+ lib/parse_subs.c |    4 +++-
+ 2 files changed, 4 insertions(+), 1 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 05e0206..3fd97d3 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -55,6 +55,7 @@
+ - remount we created mount point fix.
+ - fix double free in sasl_bind().
+ - mannual umount recovery fixes.
++- fix map type info parse error.
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/lib/parse_subs.c b/lib/parse_subs.c
+index 0cba95a..0608cb7 100644
+--- a/lib/parse_subs.c
++++ b/lib/parse_subs.c
+@@ -315,6 +315,7 @@ struct map_type_info *parse_map_type_info(const char *str)
+ {
+ 	struct map_type_info *info;
+ 	char *buf, *type, *fmt, *map, *tmp;
++	int seen_colon = 0;
+ 
+ 	buf = strdup(str);
+ 	if (!buf)
+@@ -335,11 +336,12 @@ struct map_type_info *parse_map_type_info(const char *str)
+ 		if (*tmp == ' ') {
+ 			*tmp = '\0';
+ 			break;
+-		} else if (*tmp == ',') {
++		} else if (!seen_colon && *tmp == ',') {
+ 			type = buf;
+ 			*tmp++ = '\0';
+ 			fmt = tmp;
+ 		} else if (*tmp == ':') {
++			seen_colon = 1;
+ 			if (!fmt)
+ 				type = buf;
+ 			*tmp++ = '\0';

autofs-5.0.4-fix-notify-mount-message-path.patch

@@ -0,0 +1,61 @@
+autofs-5.0.4 - fix notify mount message path
+
+From: Ian Kent <raven@themaw.net>
+
+If logging is set to verbose we want to log the actual path rather
+than the false root. Hoevever, when logging is set to debug we do
+need to show the false root to give us the true picture in relation
+to accompanying log messages.
+---
+
+ CHANGELOG         |    1 +
+ daemon/direct.c   |    5 ++++-
+ daemon/indirect.c |    5 ++++-
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index d1cc113..0a0519f 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -51,6 +51,7 @@
+ - always read file maps key lookup fixes.
+ - use srv query for domain dn.
+ - fix not releasing resources when using submounts.
++- fix notify mount message path.
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/daemon/direct.c b/daemon/direct.c
+index 1ed2b15..74a9acc 100644
+--- a/daemon/direct.c
++++ b/daemon/direct.c
+@@ -767,8 +767,11 @@ int mount_autofs_offset(struct autofs_point *ap, struct mapent *me, const char *
+ 	}
+ 
+ 	ops->timeout(ap->logopt, ioctlfd, &timeout);
+-	notify_mount_result(ap, mountpoint, str_offset);
+ 	cache_set_ino_index(me->mc, me->key, st.st_dev, st.st_ino);
++	if (ap->logopt & LOGOPT_DEBUG)
++		notify_mount_result(ap, mountpoint, str_offset);
++	else
++		notify_mount_result(ap, me->key, str_offset);
+ 	ops->close(ap->logopt, ioctlfd);
+ 
+ 	debug(ap->logopt, "mounted trigger %s at %s", me->key, mountpoint);
+diff --git a/daemon/indirect.c b/daemon/indirect.c
+index bc39e63..463b39c 100644
+--- a/daemon/indirect.c
++++ b/daemon/indirect.c
+@@ -174,7 +174,10 @@ static int do_mount_autofs_indirect(struct autofs_point *ap, const char *root)
+ 	ap->exp_runfreq = (timeout + CHECK_RATIO - 1) / CHECK_RATIO;
+ 
+ 	ops->timeout(ap->logopt, ap->ioctlfd, &timeout);
+-	notify_mount_result(ap, root, str_indirect);
++	if (ap->logopt & LOGOPT_DEBUG)
++		notify_mount_result(ap, root, str_indirect);
++	else
++		notify_mount_result(ap, ap->path, str_indirect);
+ 
+ 	return 0;
+ 

autofs-5.0.4-library-reload-fix-update-fix-2.patch

@@ -0,0 +1,53 @@
+autofs-5.0.4 - library reload fix update fix 2
+
+From: Ian Kent <raven@themaw.net>
+
+The library reload fixes introduced a bug which causes autofs to
+not release mount thread resources when using submounts.
+---
+
+ CHANGELOG          |    1 +
+ daemon/automount.c |   11 +++++++++--
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index f49784a..d1cc113 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -50,6 +50,7 @@
+ - always read file maps multi map fix.
+ - always read file maps key lookup fixes.
+ - use srv query for domain dn.
++- fix not releasing resources when using submounts.
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/daemon/automount.c b/daemon/automount.c
+index 3a0fe0b..44dcdd6 100644
+--- a/daemon/automount.c
++++ b/daemon/automount.c
+@@ -1460,14 +1460,21 @@ static void handle_mounts_cleanup(void *arg)
+ 	master_remove_mapent(ap->entry);
+ 	master_source_unlock(ap->entry);
+ 
++	destroy_logpri_fifo(ap);
++
++	/*
++	 * Submounts are detached threads and don't belong to the
++	 * master map entry list so we need to free their resources
++	 * here.
++	 */
+ 	if (submount) {
+ 		mounts_mutex_unlock(ap->parent);
+ 		master_source_unlock(ap->parent->entry);
++		master_free_mapent_sources(ap->entry, 1);
++		master_free_mapent(ap->entry);
+ 	}
+ 	master_mutex_unlock();
+ 
+-	destroy_logpri_fifo(ap);
+-
+ 	if (clean) {
+ 		if (rmdir(path) == -1) {
+ 			char *estr = strerror_r(errno, buf, MAX_ERR_BUF);

autofs-5.0.4-manual-umount-recovery-fixes.patch

@@ -0,0 +1,100 @@
+autofs-5.0.4 - mannual umount recovery fixes
+
+From: Ian Kent <raven@themaw.net>
+
+Check for the absence of a mount before doing the manual umount
+checks and check ioctlfd is valid seperately. Take a write lock
+on the map entry mutex to ensure any mount request is complete
+before checking.
+---
+
+ CHANGELOG         |    1 +
+ daemon/direct.c   |    4 ++--
+ daemon/indirect.c |   37 +++++++++++++++++++++++--------------
+ 3 files changed, 26 insertions(+), 16 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index f0d0e58..05e0206 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -54,6 +54,7 @@
+ - fix notify mount message path.
+ - remount we created mount point fix.
+ - fix double free in sasl_bind().
++- mannual umount recovery fixes.
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/daemon/direct.c b/daemon/direct.c
+index 74a9acc..7b02c7a 100644
+--- a/daemon/direct.c
++++ b/daemon/direct.c
+@@ -889,9 +889,9 @@ void *expire_proc_direct(void *arg)
+ 			/* Check for manual umount */
+ 			cache_writelock(me->mc);
+ 			if (me->ioctlfd != -1 && 
+-			    fstat(ioctlfd, &st) != -1 &&
++			    fstat(me->ioctlfd, &st) != -1 &&
+ 			    !count_mounts(ap->logopt, next->path, st.st_dev)) {
+-				ops->close(ap->logopt, ioctlfd);
++				ops->close(ap->logopt, me->ioctlfd);
+ 				me->ioctlfd = -1;
+ 				cache_unlock(me->mc);
+ 				pthread_setcancelstate(cur_state, NULL);
+diff --git a/daemon/indirect.c b/daemon/indirect.c
+index 463b39c..8025ee4 100644
+--- a/daemon/indirect.c
++++ b/daemon/indirect.c
+@@ -437,7 +437,19 @@ void *expire_proc_indirect(void *arg)
+ 				struct mapent *me = NULL;
+ 				struct stat st;
+ 
+-				master_source_readlock(ap->entry);
++				/* It's got a mount, deal with in the outer loop */
++				if (is_mounted(_PATH_MOUNTED, next->path, MNTS_REAL)) {
++					pthread_setcancelstate(cur_state, NULL);
++					continue;
++				}
++
++				/* Don't touch submounts */
++				if (master_find_submount(ap, next->path)) {
++					pthread_setcancelstate(cur_state, NULL);
++					continue;
++				}
++
++				master_source_writelock(ap->entry);
+ 
+ 				map = ap->entry->maps;
+ 				while (map) {
+@@ -456,20 +468,17 @@ void *expire_proc_indirect(void *arg)
+ 					continue;
+ 				}
+ 
++				if (me->ioctlfd == -1) {
++					cache_unlock(mc);
++					master_source_unlock(ap->entry);
++					pthread_setcancelstate(cur_state, NULL);
++					continue;
++				}
++
+ 				/* Check for manual umount */
+-				if (me->ioctlfd != -1 &&
+-				    (fstat(me->ioctlfd, &st) == -1 ||
+-				     !count_mounts(ap->logopt, me->key, st.st_dev))) {
+-					if (is_mounted(_PROC_MOUNTS, me->key, MNTS_REAL)) {
+-						error(ap->logopt,
+-						      "error: possible mtab mismatch %s",
+-						      me->key);
+-						cache_unlock(mc);
+-						master_source_unlock(ap->entry);
+-						pthread_setcancelstate(cur_state, NULL);
+-						continue;
+-					}
+-					close(me->ioctlfd);
++				if (fstat(me->ioctlfd, &st) == -1 ||
++				    !count_mounts(ap->logopt, me->key, st.st_dev)) {
++					ops->close(ap->logopt, me->ioctlfd);
+ 					me->ioctlfd = -1;
+ 				}
+ 

autofs-5.0.4-remount-we-created-mount-point-fix.patch

@@ -0,0 +1,55 @@
+autofs-5.0.4 - remount we created mount point fix
+
+From: Ian Kent <raven@themaw.net>
+
+During remount determine if autofs created the mount point directory,
+as best we can.
+---
+
+ CHANGELOG    |    1 +
+ lib/mounts.c |   15 +++++++--------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 0a0519f..e138ca3 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -52,6 +52,7 @@
+ - use srv query for domain dn.
+ - fix not releasing resources when using submounts.
+ - fix notify mount message path.
++- remount we created mount point fix.
+ 
+ 4/11/2008 autofs-5.0.4
+ -----------------------
+diff --git a/lib/mounts.c b/lib/mounts.c
+index 4787bb6..4c44982 100644
+--- a/lib/mounts.c
++++ b/lib/mounts.c
+@@ -1359,18 +1359,17 @@ int try_remount(struct autofs_point *ap, struct mapent *me, unsigned int type)
+ 	/*
+ 	 * The directory must exist since we found a device
+ 	 * number for the mount but we can't know if we created
+-	 * it or not. However, if we're mounted on an autofs fs
+-	 * then we need to cleanup the path anyway.
++	 * it or not. However, if this is an indirect mount with
++	 * the nobrowse option we need to remove the mount point
++	 * directory at umount anyway.
+ 	 */
+ 	if (type == t_indirect) {
+-		ap->flags &= ~MOUNT_FLAG_DIR_CREATED;
+-		if (ret == DEV_IOCTL_IS_AUTOFS)
++		if (ap->flags & MOUNT_FLAG_GHOST)
++			ap->flags &= ~MOUNT_FLAG_DIR_CREATED;
++		else
+ 			ap->flags |= MOUNT_FLAG_DIR_CREATED;
+-	} else {
++	} else
+ 		me->flags &= ~MOUNT_FLAG_DIR_CREATED;
+-		if (ret == DEV_IOCTL_IS_AUTOFS)
+-			me->flags |= MOUNT_FLAG_DIR_CREATED;
+-	}
+ 
+ 	/*
+ 	 * Either we opened the mount or we're re-reading the map.

autofs-5.0.4-srv-lookup-handle-endian.patch

@@ -0,0 +1,37 @@
+autofs-5.0.4 - srv lookup handle endianness
+
+From: Ian Kent <raven@themaw.net>
+
+
+---
+
+ modules/dclist.c |    6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+
+diff --git a/modules/dclist.c b/modules/dclist.c
+index 5b0e577..967581c 100644
+--- a/modules/dclist.c
++++ b/modules/dclist.c
+@@ -34,6 +34,7 @@
+ #include <ldap.h>
+ #include <sys/param.h>
+ #include <errno.h>
++#include <endian.h>
+ 
+ #include "automount.h"
+ #include "dclist.h"
+@@ -72,8 +73,13 @@
+ #define SVAL(buf, pos) (*(const uint16_t *)((const char *)(buf) + (pos)))
+ #define IVAL(buf, pos) (*(const uint32_t *)((const char *)(buf) + (pos)))
+ 
++#if __BYTE_ORDER == __LITTLE_ENDIAN
+ #define SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF))
+ #define IREV(x) ((SREV(x)<<16) | (SREV((x)>>16)))
++#else
++#define SREV(x) (x)
++#define IREV(x) (x)
++#endif
+ 
+ #define RSVAL(buf, pos) SREV(SVAL(buf, pos))
+ #define RIVAL(buf, pos) IREV(IVAL(buf, pos))

autofs.spec

@@ -4,7 +4,7 @@
 Summary: A tool for automatically mounting and unmounting filesystems
 Name: autofs
 Version: 5.0.4
-Release: 28
+Release: 30
 Epoch: 1
 License: GPLv2+
 Group: System Environment/Daemons
@@ -60,6 +60,14 @@ Patch47: autofs-5.0.4-dont-fail-on-ipv6-address-adding-host.patch
 Patch48: autofs-5.0.4-always-read-file-maps-multi-map-fix.patch
 Patch49: autofs-5.0.4-always-read-file-maps-key-lookup-fixes.patch
 Patch50: autofs-5.0.4-use-srv-query-for-domain-dn.patch
+Patch51: autofs-5.0.4-fix-incorrect-dclist-free.patch
+Patch52: autofs-5.0.4-srv-lookup-handle-endian.patch
+Patch53: autofs-5.0.4-library-reload-fix-update-fix-2.patch
+Patch54: autofs-5.0.4-fix-notify-mount-message-path.patch
+Patch55: autofs-5.0.4-remount-we-created-mount-point-fix.patch
+Patch56: autofs-5.0.4-fix-double-free-in-do_sasl_bind.patch
+Patch57: autofs-5.0.4-manual-umount-recovery-fixes.patch
+Patch58: autofs-5.0.4-fix-map-type-info-parse-error.patch
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: autoconf, hesiod-devel, openldap-devel, bison, flex, libxml2-devel, cyrus-sasl-devel, openssl-devel module-init-tools util-linux nfs-utils e2fsprogs libtirpc-devel
 Requires: kernel >= 2.6.17
@@ -151,6 +159,14 @@ echo %{version}-%{release} > .version
 %patch48 -p1
 %patch49 -p1
 %patch50 -p1
+%patch51 -p1
+%patch52 -p1
+%patch53 -p1
+%patch54 -p1
+%patch55 -p1
+%patch56 -p1
+%patch57 -p1
+%patch58 -p1
 
 %build
 #CFLAGS="$RPM_OPT_FLAGS" ./configure --prefix=/usr --libdir=%{_libdir}
@@ -203,6 +219,17 @@ fi
 %{_libdir}/autofs/
 
 %changelog
+* Fri Jun 12 2009 Ian Kent <ikent@redhat.com> - 1:5.0.4-30
+- fix incorrect dclist free.
+- srv lookup handle endianness.
+- fix bug introduced by library reload changes which causes autofs to
+  not release mount thread resources when using submounts.
+- fix notify mount message path.
+- try harder to work out if we created mount point at remount.
+- fix double free in do_sasl_bind().
+- manual umount recovery fixes.
+- fix map type info parse error.
+
 * Mon May 18 2009 Ian Kent <ikent@redhat.com> - 1:5.0.4-28
 - use intr option as hosts mount default.
 - sync kernel includes with upstream kernel.