umount: umount -r segfault

umount(8) segfaults when update incomplete mtab file after remount to
read-only (-r). For example autofs does not store info about
mountpoint to /etc/mtab file.

	# mount /dev/sda1 /mnt/test
	# sed -i -e 's:/dev/sda1 .*::g' /etc/mtab
	# cd /mnt/test
	# umount -r /mnt/test
	umount: /mnt/test busy - remounted read-only
	Segmentation fault

The command "umount -r" should not care about /etc/mtab if the related
mtab entry does not exist.

Reported-by: Paul Crawford <psc@sat.dundee.ac.uk>
Addresses: https://bugs.launchpad.net/bugs/579858
Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/mount/umount.c b/mount/umount.c
index 49741a51929a3e5756b28f75c5de76e98e3bf1dd..b5ff8a17706b4fe02c2d1cc0552f5260649c5e27 100644 (file)
--- a/mount/umount.c
+++ b/mount/umount.c
@@ -267,15 +267,20 @@ umount_one (const char *spec, const char *node, const char *type,
                res = mount(spec, node, NULL,
                            MS_MGC_VAL | MS_REMOUNT | MS_RDONLY, NULL);
                if (res == 0) {
-                       struct my_mntent remnt;
                        fprintf(stderr,
                                _("umount: %s busy - remounted read-only\n"),
                                spec);
-                       remnt.mnt_type = remnt.mnt_fsname = NULL;
-                       remnt.mnt_dir = xstrdup(node);
-                       remnt.mnt_opts = xstrdup("ro");
-                       if (!nomtab)
+                       if (mc && !nomtab) {
+                               /* update mtab if the entry is there */
+                               struct my_mntent remnt;
+                               remnt.mnt_fsname = mc->m.mnt_fsname;
+                               remnt.mnt_dir = mc->m.mnt_dir;
+                               remnt.mnt_type = mc->m.mnt_type;
+                               remnt.mnt_opts = "ro";
+                               remnt.mnt_freq = 0;
+                               remnt.mnt_passno = 0;
                                update_mtab(node, &remnt);
+                       }
                        return 0;
                } else if (errno != EBUSY) {    /* hmm ... */
                        perror("remount");