diff mbox

[4/7] cifs: fix a possible null pointer deref in decode_ascii_ssetup

Message ID 003701cfbc63$04fdf490$0ef9ddb0$@samsung.com (mailing list archive)
State New, archived
Headers show

Commit Message

Namjae Jeon Aug. 20, 2014, 10:39 a.m. UTC
When kzalloc fails, we will end up doing NULL pointer derefrence

Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Ashish Sangwan <a.sangwan@samsung.com>
---
 fs/cifs/sess.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

Comments

Steve French Aug. 21, 2014, 12:07 a.m. UTC | #1
merged into cifs-2.6.git for-next

On Wed, Aug 20, 2014 at 5:39 AM, Namjae Jeon <namjae.jeon@samsung.com> wrote:
> When kzalloc fails, we will end up doing NULL pointer derefrence
>
> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
> Signed-off-by: Ashish Sangwan <a.sangwan@samsung.com>
> ---
>  fs/cifs/sess.c |    7 ++++---
>  1 files changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
> index 39b8507..07fe97a 100644
> --- a/fs/cifs/sess.c
> +++ b/fs/cifs/sess.c
> @@ -243,10 +243,11 @@ static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
>         kfree(ses->serverOS);
>
>         ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
> -       if (ses->serverOS)
> +       if (ses->serverOS) {
>                 strncpy(ses->serverOS, bcc_ptr, len);
> -       if (strncmp(ses->serverOS, "OS/2", 4) == 0)
> -               cifs_dbg(FYI, "OS/2 server\n");
> +               if (strncmp(ses->serverOS, "OS/2", 4) == 0)
> +                       cifs_dbg(FYI, "OS/2 server\n");
> +       }
>
>         bcc_ptr += len + 1;
>         bleft -= len + 1;
> --
> 1.7.7
>
diff mbox

Patch

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 39b8507..07fe97a 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -243,10 +243,11 @@  static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
 	kfree(ses->serverOS);
 
 	ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
-	if (ses->serverOS)
+	if (ses->serverOS) {
 		strncpy(ses->serverOS, bcc_ptr, len);
-	if (strncmp(ses->serverOS, "OS/2", 4) == 0)
-		cifs_dbg(FYI, "OS/2 server\n");
+		if (strncmp(ses->serverOS, "OS/2", 4) == 0)
+			cifs_dbg(FYI, "OS/2 server\n");
+	}
 
 	bcc_ptr += len + 1;
 	bleft -= len + 1;