lkml.org 
[lkml]   [2019]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] fs: nfsd: Fix three possible null-pointer dereferences
On Wed, Jul 24, 2019 at 04:28:03PM +0800, Jia-Ju Bai wrote:
> In nfs4_xdr_dec_cb_recall(), nfs4_xdr_dec_cb_layout() and
> nfs4_xdr_dec_cb_notify_lock(), there is an if statement to check whether
> cb is NULL.
>
> When cb is NULL, the three functions all call:
> decode_cb_op_status(..., &cb->cb_status);
>
> Thus, possible null-pointer dereferences may occur.
>
> To fix these possible bugs, -EINVAL is returned when cb is NULL.
>
> These bugs are found by a static analysis tool STCheck written by us.

Thanks! But I think actually the correct fix is just to remove the NULL
checks entirely.

--b.

>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
> ---
> fs/nfsd/nfs4callback.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
> index 397eb7820929..55949a158b6b 100644
> --- a/fs/nfsd/nfs4callback.c
> +++ b/fs/nfsd/nfs4callback.c
> @@ -516,7 +516,8 @@ static int nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp,
> status = decode_cb_sequence4res(xdr, cb);
> if (unlikely(status || cb->cb_seq_status))
> return status;
> - }
> + } else
> + return -EINVAL;
>
> return decode_cb_op_status(xdr, OP_CB_RECALL, &cb->cb_status);
> }
> @@ -608,7 +609,9 @@ static int nfs4_xdr_dec_cb_layout(struct rpc_rqst *rqstp,
> status = decode_cb_sequence4res(xdr, cb);
> if (unlikely(status || cb->cb_seq_status))
> return status;
> - }
> + } else
> + return -EINVAL;
> +
> return decode_cb_op_status(xdr, OP_CB_LAYOUTRECALL, &cb->cb_status);
> }
> #endif /* CONFIG_NFSD_PNFS */
> @@ -667,7 +670,9 @@ static int nfs4_xdr_dec_cb_notify_lock(struct rpc_rqst *rqstp,
> status = decode_cb_sequence4res(xdr, cb);
> if (unlikely(status || cb->cb_seq_status))
> return status;
> - }
> + } else
> + return -EINVAL;
> +
> return decode_cb_op_status(xdr, OP_CB_NOTIFY_LOCK, &cb->cb_status);
> }
>
> --
> 2.17.0

\
 
 \ /
  Last update: 2019-07-31 01:04    [W:0.031 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site