From da473ba950218c155b8b640b6288e2776ab9fc13 Mon Sep 17 00:00:00 2001 From: Hawkins Jiawei Date: Mon, 6 Mar 2023 15:07:21 +0800 Subject: [PATCH] nfs: fix possible null-ptr-deref when parsing param ANBZ: #4370 commit 5559405df652008e56eee88872126fe4c451da67 upstream. According to commit "vfs: parse: deal with zero length string value", kernel will set the param->string to null pointer in vfs_parse_fs_string() if fs string has zero length. Yet the problem is that, nfs_fs_context_parse_param() will dereferences the param->string, without checking whether it is a null pointer, which may trigger a null-ptr-deref bug. This patch solves it by adding sanity check on param->string in nfs_fs_context_parse_param(). Signed-off-by: Hawkins Jiawei Reviewed-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: bruce --- fs/nfs/fs_context.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c index d60c086c6e9c..7e21a0ce78d6 100644 --- a/fs/nfs/fs_context.c +++ b/fs/nfs/fs_context.c @@ -637,6 +637,8 @@ static int nfs_fs_context_parse_param(struct fs_context *fc, return ret; break; case Opt_vers: + if (!param->string) + goto out_invalid_value; ret = nfs_parse_version_string(fc, param->string); if (ret < 0) return ret; @@ -648,6 +650,8 @@ static int nfs_fs_context_parse_param(struct fs_context *fc, break; case Opt_proto: + if (!param->string) + goto out_invalid_value; protofamily = AF_INET; switch (lookup_constant(nfs_xprt_protocol_tokens, param->string, -1)) { case Opt_xprt_udp6: @@ -681,6 +685,8 @@ static int nfs_fs_context_parse_param(struct fs_context *fc, break; case Opt_mountproto: + if (!param->string) + goto out_invalid_value; mountfamily = AF_INET; switch (lookup_constant(nfs_xprt_protocol_tokens, param->string, -1)) { case Opt_xprt_udp6: -- Gitee