]> git.karo-electronics.de Git - karo-tx-linux.git/commit
NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free()
authorKinglong Mee <kinglongmee@gmail.com>
Fri, 23 May 2014 11:57:49 +0000 (19:57 +0800)
committerJ. Bruce Fields <bfields@redhat.com>
Wed, 28 May 2014 18:53:12 +0000 (14:53 -0400)
commit0a9cd919219a7ac6a413912ff4e4ebde9ca59b92
tree49435ca43beebfee6bc1d5d2754fdcd96a50f2b2
parentadd221765e4085e0f12dcf3cebfc48243a92b4bc
NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free()

If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c
 411
 412         fsloc->locations = kzalloc(fsloc->locations_count
 413                         * sizeof(struct nfsd4_fs_location), GFP_KERNEL);
 414         if (!fsloc->locations)
 415                 return -ENOMEM;

svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL,
so that, "kfree(fsloc->locations[i].path);" will cause a crash.

If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(),
and svc_export_parse() will call it again, so that, a double free is caused.

This patch checks the fsloc->locations, and set to NULL after it be freed.

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
fs/nfsd/export.c