From patchwork Fri May 23 11:57:49 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kinglong Mee X-Patchwork-Id: 4231891 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 2325B9F32B for ; Fri, 23 May 2014 11:58:18 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5E06D2034B for ; Fri, 23 May 2014 11:58:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 751152022A for ; Fri, 23 May 2014 11:58:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752094AbaEWL6P (ORCPT ); Fri, 23 May 2014 07:58:15 -0400 Received: from mail-qg0-f45.google.com ([209.85.192.45]:64060 "EHLO mail-qg0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751404AbaEWL6O (ORCPT ); Fri, 23 May 2014 07:58:14 -0400 Received: by mail-qg0-f45.google.com with SMTP id z60so7633784qgd.4 for ; Fri, 23 May 2014 04:58:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :content-type:content-transfer-encoding; bh=JYX/Q4hl6W3XEnw1SSbekCGhLJsPsoHKBsjErIrtwYI=; b=fl/m4OvzIMbh7y3BEkSUcGpH++FZYdc8cipv84ncjAZCVOaFj1TZfZHakOrsQLqYuU B/J60Vh0ciSgARXVeSA4sOQQvU2rUCyhB78bi8Ch6Tv0JIV2zibV1qbaYYF68LuF48Wp Gdc75HNKR4aEpu6N4TrD9LfDxfE96Nv1YhnraXuQ8jDzKMgKDRYjWLP87sxSSsZnNb7G phukm5UB5KZMVufY0hIkkzADbpbAApMHlX98IH/e07XjZH8gu5iKMtCNMn14BItNr+Ap ULgG9RrxoLIypEURb6NzwrpSF92PX52wndwMO3Y7/bi31IjP2eAI2M3oqgiuyyiQFu7T ONNQ== X-Received: by 10.224.98.141 with SMTP id q13mr5810974qan.64.1400846294051; Fri, 23 May 2014 04:58:14 -0700 (PDT) Received: from [192.168.31.158] ([118.117.113.227]) by mx.google.com with ESMTPSA id g8sm1802419qgf.43.2014.05.23.04.58.06 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 23 May 2014 04:58:13 -0700 (PDT) Message-ID: <537F37BD.9070005@gmail.com> Date: Fri, 23 May 2014 19:57:49 +0800 From: Kinglong Mee User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: "J. Bruce Fields" CC: Linux NFS Mailing List , kinglongmee@gmail.com Subject: [PATCH 1/4] NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free() Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c 411 412 fsloc->locations = kzalloc(fsloc->locations_count 413 * sizeof(struct nfsd4_fs_location), GFP_KERNEL); 414 if (!fsloc->locations) 415 return -ENOMEM; svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL, so that, "kfree(fsloc->locations[i].path);" will cause a crash. If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(), and svc_export_parse() will call it again, so that, a double free is caused. This patch checks the fsloc->locations, and set to NULL after it be freed. Signed-off-by: Kinglong Mee --- fs/nfsd/export.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c index 8513c59..9a41d3d 100644 --- a/fs/nfsd/export.c +++ b/fs/nfsd/export.c @@ -295,13 +295,19 @@ svc_expkey_update(struct cache_detail *cd, struct svc_expkey *new, static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc) { + struct nfsd4_fs_location *locations = fsloc->locations; int i; + if (!locations) + return; + for (i = 0; i < fsloc->locations_count; i++) { - kfree(fsloc->locations[i].path); - kfree(fsloc->locations[i].hosts); + kfree(locations[i].path); + kfree(locations[i].hosts); } - kfree(fsloc->locations); + + kfree(locations); + fsloc->locations = NULL; } static void svc_export_put(struct kref *ref)