NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free()

If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c
 411
 412         fsloc->locations = kzalloc(fsloc->locations_count
 413                         * sizeof(struct nfsd4_fs_location), GFP_KERNEL);
 414         if (!fsloc->locations)
 415                 return -ENOMEM;

svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL,
so that, "kfree(fsloc->locations[i].path);" will cause a crash.

If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(),
and svc_export_parse() will call it again, so that, a double free is caused.

This patch checks the fsloc->locations, and set to NULL after it be freed.

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 8513c598fabfbb7cc83e32357d4ff0f6ba8e087d..9a41d3ddd8dfe1d11441b9401b030773880dc0dc 100644 (file)
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -295,13 +295,19 @@ svc_expkey_update(struct cache_detail *cd, struct svc_expkey *new,
 
 static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc)
 {
+       struct nfsd4_fs_location *locations = fsloc->locations;
        int i;
 
+       if (!locations)
+               return;
+
        for (i = 0; i < fsloc->locations_count; i++) {
-               kfree(fsloc->locations[i].path);
-               kfree(fsloc->locations[i].hosts);
+               kfree(locations[i].path);
+               kfree(locations[i].hosts);
        }
-       kfree(fsloc->locations);
+
+       kfree(locations);
+       fsloc->locations = NULL;
 }
 
 static void svc_export_put(struct kref *ref)