NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free()
If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c 411 412 fsloc->locations = kzalloc(fsloc->locations_count 413 * sizeof(struct nfsd4_fs_location), GFP_KERNEL); 414 if (!fsloc->locations) 415 return -ENOMEM; svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL, so that, "kfree(fsloc->locations[i].path);" will cause a crash. If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(), and svc_export_parse() will call it again, so that, a double free is caused. This patch checks the fsloc->locations, and set to NULL after it be freed. Signed-off-by: Kinglong Mee <kinglongmee@gmail.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
parent
a5cddc885b
commit
a1f05514b0
|
@ -295,13 +295,19 @@ svc_expkey_update(struct cache_detail *cd, struct svc_expkey *new,
|
|||
|
||||
static void nfsd4_fslocs_free(struct nfsd4_fs_locations *fsloc)
|
||||
{
|
||||
struct nfsd4_fs_location *locations = fsloc->locations;
|
||||
int i;
|
||||
|
||||
if (!locations)
|
||||
return;
|
||||
|
||||
for (i = 0; i < fsloc->locations_count; i++) {
|
||||
kfree(fsloc->locations[i].path);
|
||||
kfree(fsloc->locations[i].hosts);
|
||||
kfree(locations[i].path);
|
||||
kfree(locations[i].hosts);
|
||||
}
|
||||
kfree(fsloc->locations);
|
||||
|
||||
kfree(locations);
|
||||
fsloc->locations = NULL;
|
||||
}
|
||||
|
||||
static void svc_export_put(struct kref *ref)
|
||||
|
|
Loading…
Reference in a new issue