Skip to contentSkip to conversation

nfsd: fix NULL dereference in nfsd_statfs()

PATCH In review Takashi Iwai 4 participants 5 messages Aug 13, 2010 – Aug 20, 2010

Subsystems (2)
NFS client NFS server
lore
Share & tools
lore

Takashi Iwai

author
#0 lore raw

PATCH 1/1 nfsd: fix NULL dereference in nfsd_statfs()

The commit ebabe9a9001af0af56c0c2780ca1576246e7a74b
pass a struct path to vfs_statfs
introduced the struct path initialization, and this seems to trigger an Oops on my machine.

fh_dentry field may be NULL and set later in fh_verify(), thus the initialization of path must be after fh_verify().

Signed-off-by Takashi Iwai <[email protected]>
---
 fs/nfsd/vfs.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)
fs/nfsd/vfs.c +8 -6
index 96360a8..661a6cf 100644
@@ -2033,15 +2033,17 @@ out:
 __be32
 nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
 {
-	struct path path = {
-		.mnt	= fhp->fh_export->ex_path.mnt,
-		.dentry	= fhp->fh_dentry,
-	};
 	__be32 err;
 
 	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
-	if (!err && vfs_statfs(&path, stat))
-		err = nfserr_io;
+	if (!err) {
+		struct path path = {
+			.mnt	= fhp->fh_export->ex_path.mnt,
+			.dentry	= fhp->fh_dentry,
+		};
+		if (vfs_statfs(&path, stat))
+			err = nfserr_io;
+	}
 	return err;
 }
Signature · 1 line
1.7.2.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 7 lines · Takashi Iwai

The commit ebabe9a9001af0af56c0c2780ca1576246e7a74b
pass a struct path to vfs_statfs
introduced the struct path initialization, and this seems to trigger an Oops on my machine.

fh_dentry field may be NULL and set later in fh_verify(), thus the initialization of path must be after fh_verify().

Thanks, the patch looks good.

Reviewed-by Christoph Hellwig <[email protected]>
Quoted 30 lines
fs/nfsd/vfs.c +8 -6
index 96360a8..661a6cf 100644
@@ -2033,15 +2033,17 @@ out:
 __be32
 nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
 {
-	struct path path = {
-		.mnt	= fhp->fh_export->ex_path.mnt,
-		.dentry	= fhp->fh_dentry,
-	};
 	__be32 err;
 
 	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
-	if (!err && vfs_statfs(&path, stat))
-		err = nfserr_io;
+	if (!err) {
+		struct path path = {
+			.mnt	= fhp->fh_export->ex_path.mnt,
+			.dentry	= fhp->fh_dentry,
+		};
+		if (vfs_statfs(&path, stat))
+			err = nfserr_io;
+	}
 	return err;
 }
Signature · 1 line
1.7.2.1

---end quoted text---

Reviewed-by on v1 1/1
#2 lore raw
In reply to Takashi Iwai
Quoted 9 lines · Takashi Iwai

The commit ebabe9a9001af0af56c0c2780ca1576246e7a74b
   pass a struct path to vfs_statfs
introduced the struct path initialization, and this seems to trigger an Oops on my machine.

fh_dentry field may be NULL and set later in fh_verify(), thus the initialization of path must be after fh_verify().

Signed-off-by Takashi Iwai <[email protected]>
Reviewed-by Minchan Kim <[email protected]>

Today, I had a same problem on mmotm so I made a similar patch. Andrew. Please apply this patch on mmotm for smooth testing.

Signature · 2 lines
Kind regards,
Minchan Kim
Acked-by on v1 1/1
#3 lore raw
In reply to Takashi Iwai
Quoted 9 lines · Takashi Iwai

The commit ebabe9a9001af0af56c0c2780ca1576246e7a74b
pass a struct path to vfs_statfs
introduced the struct path initialization, and this seems to trigger an Oops on my machine.

fh_dentry field may be NULL and set later in fh_verify(), thus the initialization of path must be after fh_verify().

Signed-off-by Takashi Iwai <[email protected]>

I'm travelling, but, looks good:

Acked-by J. Bruce Fields <[email protected]>

--b.

Quoted 35 lines
---
 fs/nfsd/vfs.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)
fs/nfsd/vfs.c +8 -6
index 96360a8..661a6cf 100644
@@ -2033,15 +2033,17 @@ out:
 __be32
 nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
 {
-	struct path path = {
-		.mnt	= fhp->fh_export->ex_path.mnt,
-		.dentry	= fhp->fh_dentry,
-	};
 	__be32 err;
 
 	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
-	if (!err && vfs_statfs(&path, stat))
-		err = nfserr_io;
+	if (!err) {
+		struct path path = {
+			.mnt	= fhp->fh_export->ex_path.mnt,
+			.dentry	= fhp->fh_dentry,
+		};
+		if (vfs_statfs(&path, stat))
+			err = nfserr_io;
+	}
 	return err;
 }
Signature · 1 line
1.7.2.1
#4 lore raw
Quoted 6 lines · J. Bruce Fields
Quoted 5 lines · Takashi Iwai

The commit ebabe9a9001af0af56c0c2780ca1576246e7a74b
pass a struct path to vfs_statfs
introduced the struct path initialization, and this seems to trigger an Oops on my machine.

Quoted 8 lines
Quoted 4 lines

fh_dentry field may be NULL and set later in fh_verify(), thus the initialization of path must be after fh_verify().

Signed-off-by Takashi Iwai <[email protected]>

I'm travelling, but, looks good:

Acked-by J. Bruce Fields <[email protected]>

Sorry for the delay, queued up to send to Linus for 2.6.36 soon.

--b.

Quoted 38 lines

--b.

Quoted 35 lines
---
 fs/nfsd/vfs.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)
fs/nfsd/vfs.c +8 -6
index 96360a8..661a6cf 100644
@@ -2033,15 +2033,17 @@ out:
 __be32
 nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
 {
-	struct path path = {
-		.mnt	= fhp->fh_export->ex_path.mnt,
-		.dentry	= fhp->fh_dentry,
-	};
 	__be32 err;
 
 	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
-	if (!err && vfs_statfs(&path, stat))
-		err = nfserr_io;
+	if (!err) {
+		struct path path = {
+			.mnt	= fhp->fh_export->ex_path.mnt,
+			.dentry	= fhp->fh_dentry,
+		};
+		if (vfs_statfs(&path, stat))
+			err = nfserr_io;
+	}
 	return err;
 }
Signature · 1 line
1.7.2.1