Commit 5559405d authored by Hawkins Jiawei's avatar Hawkins Jiawei Committed by Trond Myklebust
Browse files

nfs: fix possible null-ptr-deref when parsing param 



According to commit "vfs: parse: deal with zero length string value",
kernel will set the param->string to null pointer in vfs_parse_fs_string()
if fs string has zero length.

Yet the problem is that, nfs_fs_context_parse_param() will dereferences the
param->string, without checking whether it is a null pointer, which may
trigger a null-ptr-deref bug.

This patch solves it by adding sanity check on param->string
in nfs_fs_context_parse_param().

Signed-off-by: default avatarHawkins Jiawei <yin31149@gmail.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent d564d2c4

fs/nfs/fs_context.c

+6 −0
Original line number Diff line number Diff line
@@ -684,6 +684,8 @@ static int nfs_fs_context_parse_param(struct fs_context *fc, 
			return ret;

		break;

	case Opt_vers:

		if (!param->string)

			goto out_invalid_value;

		trace_nfs_mount_assign(param->key, param->string);

		ret = nfs_parse_version_string(fc, param->string);

		if (ret < 0)
@@ -696,6 +698,8 @@ static int nfs_fs_context_parse_param(struct fs_context *fc, 
		break;



	case Opt_proto:

		if (!param->string)

			goto out_invalid_value;

		trace_nfs_mount_assign(param->key, param->string);

		protofamily = AF_INET;

		switch (lookup_constant(nfs_xprt_protocol_tokens, param->string, -1)) {
@@ -732,6 +736,8 @@ static int nfs_fs_context_parse_param(struct fs_context *fc, 
		break;



	case Opt_mountproto:

		if (!param->string)

			goto out_invalid_value;

		trace_nfs_mount_assign(param->key, param->string);

		mountfamily = AF_INET;

		switch (lookup_constant(nfs_xprt_protocol_tokens, param->string, -1)) {