lkml.org 
[lkml]   [2015]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19 102/175] NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args
    Date
    3.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Trond Myklebust <trond.myklebust@primarydata.com>

    commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream.

    If the call to decode_rc_list() fails due to a memory allocation error,
    then we need to truncate the array size to ensure that we only call
    kfree() on those pointer that were allocated.

    Reported-by: David Ramos <daramos@stanford.edu>
    Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation")
    Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/nfs/callback_xdr.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/fs/nfs/callback_xdr.c
    +++ b/fs/nfs/callback_xdr.c
    @@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(st

    for (i = 0; i < args->csa_nrclists; i++) {
    status = decode_rc_list(xdr, &args->csa_rclists[i]);
    - if (status)
    + if (status) {
    + args->csa_nrclists = i;
    goto out_free;
    + }
    }
    }
    status = 0;



    \
     
     \ /
      Last update: 2015-03-04 07:41    [W:2.657 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site