aboutsummaryrefslogtreecommitdiffstats
path: root/fs/nfsd/export.c
diff options
context:
space:
mode:
authorKinglong Mee <kinglongmee@gmail.com>2014-05-23 07:57:49 -0400
committerJ. Bruce Fields <bfields@redhat.com>2014-05-30 17:32:18 -0400
commita1f05514b016aeaed638dbf677f443af7e7bde4f (patch)
tree92f0b908e551cf832e1ebda31724a3d898575ee9 /fs/nfsd/export.c
parenta5cddc885b99458df963a75abbe0b40cbef56c48 (diff)
NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free()
If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c 411 412 fsloc->locations = kzalloc(fsloc->locations_count 413 * sizeof(struct nfsd4_fs_location), GFP_KERNEL); 414 if (!fsloc->locations) 415 return -ENOMEM; svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL, so that, "kfree(fsloc->locations[i].path);" will cause a crash. If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(), and svc_export_parse() will call it again, so that, a double free is caused. This patch checks the fsloc->locations, and set to NULL after it be freed. Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs/nfsd/export.c')
-rw-r--r--fs/nfsd/export.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 8513c598fabf..9a41d3ddd8df 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -295,13 +295,19 @@ svc_expkey_update(struct cache_detail *cd, struct svc_expkey *new,
295 295
296static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc) 296static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc)
297{ 297{
298 struct nfsd4_fs_location *locations = fsloc->locations;
298 int i; 299 int i;
299 300
301 if (!locations)
302 return;
303
300 for (i = 0; i < fsloc->locations_count; i++) { 304 for (i = 0; i < fsloc->locations_count; i++) {
301 kfree(fsloc->locations[i].path); 305 kfree(locations[i].path);
302 kfree(fsloc->locations[i].hosts); 306 kfree(locations[i].hosts);
303 } 307 }
304 kfree(fsloc->locations); 308
309 kfree(locations);
310 fsloc->locations = NULL;
305} 311}
306 312
307static void svc_export_put(struct kref *ref) 313static void svc_export_put(struct kref *ref)