diff options
| author | Kinglong Mee <kinglongmee@gmail.com> | 2014-05-23 13:57:49 +0200 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2014-05-30 23:32:18 +0200 |
| commit | a1f05514b016aeaed638dbf677f443af7e7bde4f (patch) | |
| tree | 92f0b908e551cf832e1ebda31724a3d898575ee9 /firmware | |
| parent | nfsd4: better reservation of head space for krb5 (diff) | |
| download | linux-a1f05514b016aeaed638dbf677f443af7e7bde4f.tar.xz linux-a1f05514b016aeaed638dbf677f443af7e7bde4f.zip | |
NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free()
If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c
411
412 fsloc->locations = kzalloc(fsloc->locations_count
413 * sizeof(struct nfsd4_fs_location), GFP_KERNEL);
414 if (!fsloc->locations)
415 return -ENOMEM;
svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL,
so that, "kfree(fsloc->locations[i].path);" will cause a crash.
If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(),
and svc_export_parse() will call it again, so that, a double free is caused.
This patch checks the fsloc->locations, and set to NULL after it be freed.
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'firmware')
0 files changed, 0 insertions, 0 deletions