Commit 10aa1452 authored by Tomas Bortoli's avatar Tomas Bortoli Committed by Dominique Martinet
Browse files

9p: fix multiple NULL-pointer-dereferences 

Added checks to prevent GPFs from raising.

Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbortoli@gmail.com


Signed-off-by: default avatarTomas Bortoli <tomasbortoli@gmail.com>
Reported-by: default avatar <syzbot+1a262da37d3bead15c39@syzkaller.appspotmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDominique Martinet <dominique.martinet@cea.fr>
parent 3111784b

net/9p/trans_fd.c

+4 −1
Original line number Diff line number Diff line
@@ -945,7 +945,7 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args) 
	if (err < 0)

		return err;



	if (valid_ipaddr4(addr) < 0)

	if (addr == NULL || valid_ipaddr4(addr) < 0)

		return -EINVAL;



	csocket = NULL;
@@ -995,6 +995,9 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args) 


	csocket = NULL;



	if (addr == NULL)

		return -EINVAL;



	if (strlen(addr) >= UNIX_PATH_MAX) {

		pr_err("%s (%d): address too long: %s\n",

		       __func__, task_pid_nr(current), addr);

net/9p/trans_rdma.c

+3 −0
Original line number Diff line number Diff line
@@ -645,6 +645,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args) 
	struct rdma_conn_param conn_param;

	struct ib_qp_init_attr qp_attr;



	if (addr == NULL)

		return -EINVAL;



	/* Parse the transport specific mount options */

	err = parse_opts(args, &opts);

	if (err < 0)

net/9p/trans_virtio.c

+3 −0
Original line number Diff line number Diff line
@@ -654,6 +654,9 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args) 
	int ret = -ENOENT;

	int found = 0;



	if (devname == NULL)

		return -EINVAL;



	mutex_lock(&virtio_9p_lock);

	list_for_each_entry(chan, &virtio_chan_list, chan_list) {

		if (!strncmp(devname, chan->tag, chan->tag_len) &&

net/9p/trans_xen.c

+3 −0
Original line number Diff line number Diff line
@@ -94,6 +94,9 @@ static int p9_xen_create(struct p9_client *client, const char *addr, char *args) 
{

	struct xen_9pfs_front_priv *priv;



	if (addr == NULL)

		return -EINVAL;



	read_lock(&xen_9pfs_lock);

	list_for_each_entry(priv, &xen_9pfs_devs, list) {

		if (!strcmp(priv->tag, addr)) {