diff mbox

NFS: fix potential NULL deref in nfs_closedir()

Message ID 1426911678-25306-1-git-send-email-tsgatesv@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Taesoo Kim March 21, 2015, 4:21 a.m. UTC 
From: Byoungyoung Lee <lifeasageek@gmail.com>

When filp->private_data is NULL, put_nfs_open_dir_context()
deferences its pointer (fi->list, fi->cred), similar to what
other file systems handle '.release' api (9p, cifs, btrfs, 
ext4, ocfs2).

Signed-off-by: Byoungyoung Lee <lifeasageek@gmail.com>
Signed-off-by: Taesoo Kim <tsgatesv@gmail.com>
---
 fs/nfs/dir.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Christoph Hellwig March 21, 2015, 6:01 p.m. UTC | #1 
On Sat, Mar 21, 2015 at 12:21:18AM -0400, Taesoo Kim wrote:
> From: Byoungyoung Lee <lifeasageek@gmail.com>
> 
> When filp->private_data is NULL, put_nfs_open_dir_context()
> deferences its pointer (fi->list, fi->cred), similar to what
> other file systems handle '.release' api (9p, cifs, btrfs, 
> ext4, ocfs2).

Why woud filp->private_data ever be NULL here?
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Taesoo Kim March 21, 2015, 6:47 p.m. UTC | #2 
Ops. After reading nfs code, we also find out that nfs_opendir()
always allocates ctx obj (for private_data), unlike other fs allocate
private_data right before seeking dentries.

Sorry for the false alarm.

Taesoo

On 03/21/15 at 11:01am, Christoph Hellwig wrote:
> On Sat, Mar 21, 2015 at 12:21:18AM -0400, Taesoo Kim wrote:
> > From: Byoungyoung Lee <lifeasageek@gmail.com>
> > 
> > When filp->private_data is NULL, put_nfs_open_dir_context()
> > deferences its pointer (fi->list, fi->cred), similar to what
> > other file systems handle '.release' api (9p, cifs, btrfs, 
> > ext4, ocfs2).
> 
> Why woud filp->private_data ever be NULL here?
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index c19e16f..434ecf1 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -133,7 +133,8 @@  out:
 static int
 nfs_closedir(struct inode *inode, struct file *filp)
 {
-	put_nfs_open_dir_context(file_inode(filp), filp->private_data);
+	if (filp->private_data)
+		put_nfs_open_dir_context(file_inode(filp), filp->private_data);
 	return 0;
 }