9p: fix multiple NULL-pointer-dereferences
Subsystems (3)
PATCH 1/1 9p: fix multiple NULL-pointer-dereferences
Added checks to prevent GPFs from raising.
Signed-off-by Tomas Bortoli <[email protected]>
--- net/9p/trans_fd.c | 5 ++++- net/9p/trans_rdma.c | 3 +++ net/9p/trans_virtio.c | 3 +++ net/9p/trans_xen.c | 3 +++ 4 files changed, 13 insertions(+), 1 deletion(-)
net/9p/trans_fd.c +4 -1
@@ -945,7 +945,7 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)if (err <0 )return err; -if (valid_ipaddr4 (addr) <0 ) +if (addr ==NULL ||valid_ipaddr4 (addr) <0 )return -EINVAL ; csocket =NULL ;
@@ -995,6 +995,9 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args) csocket =NULL ; +if (addr ==NULL ) +return -EINVAL ; +if (strlen (addr) >=UNIX_PATH_MAX ) {pr_err ("%s (%d): address too long: %s\n" , __func__,task_pid_nr (current), addr);
net/9p/trans_rdma.c +3 -0
@@ -645,6 +645,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)struct rdma_conn_param conn_param;struct ib_qp_init_attr qp_attr; +if (addr ==NULL ) +return -EINVAL ; +/* Parse the transport specific mount options */ err =parse_opts (args, &opts);if (err <0 )
net/9p/trans_virtio.c +3 -0
@@ -654,6 +654,9 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)int ret = -ENOENT ;int found =0 ; +if (devname ==NULL ) +return -EINVAL ; +mutex_lock (&virtio_9p_lock);list_for_each_entry (chan, &virtio_chan_list, chan_list) { if (!strncmp(devname, chan->tag, chan->tag_len) &&
net/9p/trans_xen.c +3 -0
@@ -94,6 +94,9 @@ static int p9_xen_create(struct p9_client *client, const char *addr, char *args) {struct xen_9pfs_front_priv *priv; +if (addr ==NULL ) +return -EINVAL ; +read_lock (&xen_9pfs_lock);list_for_each_entry (priv, &xen_9pfs_devs, list) {if (!strcmp (priv->tag, addr)) {
Signature · 1 line
2.11.0
Quoted 1 line · Tomas Bortoli
Added checks to prevent GPFs from raising.
This supersedes the previous patch, right? If so please add:
Reported-by [email protected]
so that the bug will be auto-closed.
Quoted 80 lines
Signed-off-by Tomas Bortoli <[email protected]>--- net/9p/trans_fd.c | 5 ++++- net/9p/trans_rdma.c | 3 +++ net/9p/trans_virtio.c | 3 +++ net/9p/trans_xen.c | 3 +++ 4 files changed, 13 insertions(+), 1 deletion(-)net/9p/trans_fd.c +4
-1@@ -945,7 +945,7 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)if (err <0 )return err; -if (valid_ipaddr4 (addr) <0 ) +if (addr ==NULL ||valid_ipaddr4 (addr) <0 )return -EINVAL ; csocket =NULL ;@@ -995,6 +995,9 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args) csocket =NULL ; +if (addr ==NULL ) +return -EINVAL ; +if (strlen (addr) >=UNIX_PATH_MAX ) {pr_err ("%s (%d): address too long: %s\n" , __func__,task_pid_nr (current), addr);net/9p/trans_rdma.c +3
-0@@ -645,6 +645,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)struct rdma_conn_param conn_param;struct ib_qp_init_attr qp_attr; +if (addr ==NULL ) +return -EINVAL ; +/* Parse the transport specific mount options */ err =parse_opts (args, &opts);if (err <0 )net/9p/trans_virtio.c +3
-0@@ -654,6 +654,9 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)int ret = -ENOENT ;int found =0 ; +if (devname ==NULL ) +return -EINVAL ; +mutex_lock (&virtio_9p_lock);list_for_each_entry (chan, &virtio_chan_list, chan_list) { if (!strncmp(devname, chan->tag, chan->tag_len) &&net/9p/trans_xen.c +3
-1@@ -94,6 +94,9 @@ static int p9_xen_create(struct p9_client *client, const char *addr, char *args) {struct xen_9pfs_front_priv *priv; +if (addr ==NULL ) +return -EINVAL ; +read_lock (&xen_9pfs_lock);list_for_each_entry (priv, &xen_9pfs_devs, list) {if (!strcmp (priv->tag, addr)) { --2.11.0
--
You received this message because you are subscribed to the Google Groups "syzkaller" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.