lkml.org 
[lkml]   [2015]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 032/221] NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args
    3.2.69-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Trond Myklebust <trond.myklebust@primarydata.com>

    commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream.

    If the call to decode_rc_list() fails due to a memory allocation error,
    then we need to truncate the array size to ensure that we only call
    kfree() on those pointer that were allocated.

    Reported-by: David Ramos <daramos@stanford.edu>
    Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation")
    Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/nfs/callback_xdr.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/fs/nfs/callback_xdr.c
    +++ b/fs/nfs/callback_xdr.c
    @@ -459,8 +459,10 @@ static __be32 decode_cb_sequence_args(st

    for (i = 0; i < args->csa_nrclists; i++) {
    status = decode_rc_list(xdr, &args->csa_rclists[i]);
    - if (status)
    + if (status) {
    + args->csa_nrclists = i;
    goto out_free;
    + }
    }
    }
    status = 0;


    \
     
     \ /
      Last update: 2015-05-05 04:21    [W:3.192 / U:0.712 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site