diff options
author | Kinglong Mee <kinglongmee@gmail.com> | 2014-05-23 07:57:49 -0400 |
---|---|---|
committer | J. Bruce Fields <bfields@redhat.com> | 2014-05-30 17:32:18 -0400 |
commit | a1f05514b016aeaed638dbf677f443af7e7bde4f (patch) | |
tree | 92f0b908e551cf832e1ebda31724a3d898575ee9 /fs/nfsd/export.c | |
parent | a5cddc885b99458df963a75abbe0b40cbef56c48 (diff) |
NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free()
If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c
411
412 fsloc->locations = kzalloc(fsloc->locations_count
413 * sizeof(struct nfsd4_fs_location), GFP_KERNEL);
414 if (!fsloc->locations)
415 return -ENOMEM;
svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL,
so that, "kfree(fsloc->locations[i].path);" will cause a crash.
If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(),
and svc_export_parse() will call it again, so that, a double free is caused.
This patch checks the fsloc->locations, and set to NULL after it be freed.
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs/nfsd/export.c')
-rw-r--r-- | fs/nfsd/export.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c index 8513c598fabf..9a41d3ddd8df 100644 --- a/fs/nfsd/export.c +++ b/fs/nfsd/export.c | |||
@@ -295,13 +295,19 @@ svc_expkey_update(struct cache_detail *cd, struct svc_expkey *new, | |||
295 | 295 | ||
296 | static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc) | 296 | static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc) |
297 | { | 297 | { |
298 | struct nfsd4_fs_location *locations = fsloc->locations; | ||
298 | int i; | 299 | int i; |
299 | 300 | ||
301 | if (!locations) | ||
302 | return; | ||
303 | |||
300 | for (i = 0; i < fsloc->locations_count; i++) { | 304 | for (i = 0; i < fsloc->locations_count; i++) { |
301 | kfree(fsloc->locations[i].path); | 305 | kfree(locations[i].path); |
302 | kfree(fsloc->locations[i].hosts); | 306 | kfree(locations[i].hosts); |
303 | } | 307 | } |
304 | kfree(fsloc->locations); | 308 | |
309 | kfree(locations); | ||
310 | fsloc->locations = NULL; | ||
305 | } | 311 | } |
306 | 312 | ||
307 | static void svc_export_put(struct kref *ref) | 313 | static void svc_export_put(struct kref *ref) |