Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp578184img; Fri, 22 Mar 2019 04:25:37 -0700 (PDT) X-Google-Smtp-Source: APXvYqxY8x/Wdi/9mO+yWUKt/lxFxlmVgRjQUtfjuClKgiw1Jl/UzBM8lXoYfsRBYIaUR5TiRsfO X-Received: by 2002:a65:5c49:: with SMTP id v9mr8505857pgr.150.1553253937339; Fri, 22 Mar 2019 04:25:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553253937; cv=none; d=google.com; s=arc-20160816; b=0L2cXLTRgODHRcDaILbZhv+bHxxjpRLy0hGwBzCWQaX2ObAhz3Gcu0+fAgR3CpGSDp HBEC1/eTvb+4KtCuPncLGLFqk2WlnMWZc8foSzHo4GfyZxEyho5SbpwdgEm+RHn7Nhl+ 3stqebjwEw0FRrVzD3UTnf8a7maYPyZhDwAkgCN9cBKG06j8QJxo8aEcHT8TEF/BRjsL WCLUTVwgAa4UgbjmszAclpy3BxhoxYjDCq0ylUu8thG5t3dqngc9kB/dXVe5CRxlVFae Xj5jOJ1PXHwrV6nys0RWeCxvdhdowcwIFXpCKtRXnl1ohvx4eiPw/vsLqN0iXYL63wC1 rOAw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=hBBxkckhJT3/RCuKJehsS7r6e/jX6Tcjmyxj51y7ksQ=; b=xlTqf+7FcvgME0J5+nm1yGkFGZhX4ir5h/uZCgEDBiXzqe/qo//845Qlm9LUtVfZAB 4hVqU1aKHcYeCpojcam32XztKwAV3UzgV+wpQKpRcR4EEVwpHXNQm1+e6i5A7U1KUBjq hM24wVYjqp8hNSkDY0xprAhy64KIlA/3jTo6/jPCDTpe1AMC68nLD4o6zgABjXqIv/EL EBYtBTkZ6ckPMrlsTeQmaIy7C8LUzdt9ikh3owPfBypBkxfWDw3x+qUQ05MZ1+GEq9sT bcO/gE0JLLNVB1XfQnr6rATsL4RLYnJhMKRszSIkxONMZBjhTBS0F3xFCYJs+mI56+JB PR9g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="z/do2tWd"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c11si6587388pga.350.2019.03.22.04.25.19; Fri, 22 Mar 2019 04:25:37 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="z/do2tWd"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727786AbfCVLXl (ORCPT + 99 others); Fri, 22 Mar 2019 07:23:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:50624 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728997AbfCVLXi (ORCPT ); Fri, 22 Mar 2019 07:23:38 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 66F10218A2; Fri, 22 Mar 2019 11:23:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253817; bh=HBwhGeHY0QNVnL1IxGf5TcB1cSDtXp6Ia2ryZf1n4+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z/do2tWdAnXxPg39R7eD4xk+hXdYwvV2UtAK6fMyRG190rBIh0YPdCtRbV8MJ/XvN yOxJC3qQlIvtMga51OPq9s2WF+4hIMzb0IQDkStj7UPjc1Rh6V2K1MvrhnOSyCKrNg 6cxlu2r2n+4V1uv+9Jhj8HC7e6vOLZruokLmfkBU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yao Liu , Anna Schumaker , Sasha Levin Subject: [PATCH 3.18 064/134] nfs: Fix NULL pointer dereference of dev_name Date: Fri, 22 Mar 2019 12:14:37 +0100 Message-Id: <20190322111214.674187569@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 80ff00172407e0aad4b10b94ef0816fc3e7813cb ] There is a NULL pointer dereference of dev_name in nfs_parse_devname() The oops looks something like: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:nfs_fs_mount+0x3b6/0xc20 [nfs] ... Call Trace: ? ida_alloc_range+0x34b/0x3d0 ? nfs_clone_super+0x80/0x80 [nfs] ? nfs_free_parsed_mount_data+0x60/0x60 [nfs] mount_fs+0x52/0x170 ? __init_waitqueue_head+0x3b/0x50 vfs_kern_mount+0x6b/0x170 do_mount+0x216/0xdc0 ksys_mount+0x83/0xd0 __x64_sys_mount+0x25/0x30 do_syscall_64+0x65/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fix this by adding a NULL check on dev_name Signed-off-by: Yao Liu Signed-off-by: Anna Schumaker Signed-off-by: Sasha Levin --- fs/nfs/super.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index 655ac3a196e4..d2fcd6e9d675 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -1876,6 +1876,11 @@ static int nfs_parse_devname(const char *dev_name, size_t len; char *end; + if (unlikely(!dev_name || !*dev_name)) { + dfprintk(MOUNT, "NFS: device name not specified\n"); + return -EINVAL; + } + /* Is the host name protected with square brakcets? */ if (*dev_name == '[') { end = strchr(++dev_name, ']'); -- 2.19.1