lkml.org 
[lkml]   [2019]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 13/79] fs: nfs: Fix possible null-pointer dereferences in encode_attrs()
    Date
    From: Jia-Ju Bai <baijiaju1990@gmail.com>

    [ Upstream commit e2751463eaa6f9fec8fea80abbdc62dbc487b3c5 ]

    In encode_attrs(), there is an if statement on line 1145 to check
    whether label is NULL:
    if (label && (attrmask[2] & FATTR4_WORD2_SECURITY_LABEL))

    When label is NULL, it is used on lines 1178-1181:
    *p++ = cpu_to_be32(label->lfs);
    *p++ = cpu_to_be32(label->pi);
    *p++ = cpu_to_be32(label->len);
    p = xdr_encode_opaque_fixed(p, label->label, label->len);

    To fix these bugs, label is checked before being used.

    These bugs are found by a static analysis tool STCheck written by us.

    Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/nfs/nfs4xdr.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
    index 1cb50bb898b01..15cd9db6d616d 100644
    --- a/fs/nfs/nfs4xdr.c
    +++ b/fs/nfs/nfs4xdr.c
    @@ -1123,7 +1123,7 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap,
    } else
    *p++ = cpu_to_be32(NFS4_SET_TO_SERVER_TIME);
    }
    - if (bmval[2] & FATTR4_WORD2_SECURITY_LABEL) {
    + if (label && (bmval[2] & FATTR4_WORD2_SECURITY_LABEL)) {
    *p++ = cpu_to_be32(label->lfs);
    *p++ = cpu_to_be32(label->pi);
    *p++ = cpu_to_be32(label->len);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-10-16 23:53    [W:4.072 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site