openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

NFS4: Avoid potential NULL pointer dereference in decode_and_add_ds(). 

On Mon, 17 Jan 2011, Mi Jinlong wrote:

>
>
> Jesper Juhl:
> > strrchr() can return NULL if nothing is found. If this happens we'll
> > dereference a NULL pointer in
> > fs/nfs/nfs4filelayoutdev.c::decode_and_add_ds().
> >
> > I tried to find some other code that guarantees that this can never
> > happen but I was unsuccessful. So, unless someone else can point to some
> > code that ensures this can never be a problem, I believe this patch is
> > needed.
> >
> > While I was changing this code I also noticed that all the dprintk()
> > statements, except one, start with "%s:". The one missing the ":" I added
> > it to.
>
>   Maybe another one also should be changed at decode_and_add_ds() at line 243:
>
>    243  printk("%s Decoded address and port %s\n", __func__, buf);
>
Missed that one. Thanks.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
This commit is contained in:
Jesper Juhl 2011-01-17 18:41:50 +00:00 committed by Trond Myklebust
parent 0da2a4ac33
commit ad3d2eedf0
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fs/nfs/nfs4filelayoutdev.c
View File

@ -214,7 +214,7 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
/* ipv6 length plus port is legal */ /* ipv6 length plus port is legal */
if (rlen > INET6_ADDRSTRLEN + 8) { if (rlen > INET6_ADDRSTRLEN + 8) {
dprintk("%s Invalid address, length %d\n", __func__, dprintk("%s: Invalid address, length %d\n", __func__,
rlen); rlen);
goto out_err; goto out_err;
} }
@ -225,6 +225,11 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
/* replace the port dots with dashes for the in4_pton() delimiter*/ /* replace the port dots with dashes for the in4_pton() delimiter*/
for (i = 0; i < 2; i++) { for (i = 0; i < 2; i++) {
char *res = strrchr(buf, '.'); char *res = strrchr(buf, '.');
if (!res) {
dprintk("%s: Failed finding expected dots in port\n",
__func__);
goto out_free;
}
*res = '-'; *res = '-';
} }
@ -240,7 +245,7 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
port = htons((tmp[0] << 8) | (tmp[1])); port = htons((tmp[0] << 8) | (tmp[1]));
ds = nfs4_pnfs_ds_add(inode, ip_addr, port); ds = nfs4_pnfs_ds_add(inode, ip_addr, port);
dprintk("%s Decoded address and port %s\n", __func__, buf); dprintk("%s: Decoded address and port %s\n", __func__, buf);
out_free: out_free:
kfree(buf); kfree(buf);
out_err: out_err: