Received: by 2002:a5b:505:0:0:0:0:0 with SMTP id o5csp1045032ybp; Thu, 17 Oct 2019 07:17:34 -0700 (PDT) X-Google-Smtp-Source: APXvYqzb9WzRmfgh0bRv+mgQ7l6Sf45B5EJ2AMUrmGRqZFE+XylCsf9FbUKu9r20OHyIzfqUqkUi X-Received: by 2002:a17:906:b74f:: with SMTP id fx15mr3656103ejb.69.1571321854290; Thu, 17 Oct 2019 07:17:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1571321854; cv=none; d=google.com; s=arc-20160816; b=zQ2N7PDuUDPDOcd0nRzRNek2ZVjJqRlaEJ1+G49nuc5YoGpQ6/0LwYqPU0pFr61dJG 1eO9+ZE8FpCuiE7cFQI7ni/adbm5E14OsuTS0euz5o5Vys3UuSuwZCd6ESbYgH8XPWiE 29sTPA4UKkQdz/WYNOuIRfluTaVfVXdrr+BAjF2U+HNM/QSfQ8nVKrYtaS6ZyH43G/RL 7Bp3ta//TSTTuwbyfN/QQUH+8f8nstchmhuGXmt7yhvOQ6awxuEmNfzaeX7ISZTglkDD cdsvdaVHv0SAHr/Kkpqg0jfP0rzBbykhL1x0GrMRQtpbPrDS17OOGD59FeO7DITR5wgO b6bA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=xCHy5QYC6xMvbzI+Y4Kgc7hGujR5rTr5CTu/TMACLJI=; b=nQe0rNl3j/YRU6hdJkTqS+mUdZXy2MrkYJMe4iFLycJShfd0/m1MbndYNx+pCYXReQ uo+AQkahI3Cyf/O8jv288SqB0dZhQJ/z+jCHlN06umffvxURo69vgSU/dS99aBcz14NT iXqOkjoWHUz5O2nCyfKCGUgUewjRVtXuM9G/4FVxrIL9pOyqJYTWSAK6AAAKAw4byKO+ DcBqMIDRBJbe0/rwYV4G2GkT8ZQBRqb1V7iYn28fjifAqENSaGpcSNUI/+PUUIVCrjW8 ugZDZV1wE1q+xWTWtm003YIkTf47slNt0QJfwuU10TbjvXcOejZkqLtk0SEoeGmBPr+z A9RA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=n7P+0oLw; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i12si1464527ejj.119.2019.10.17.07.17.11; Thu, 17 Oct 2019 07:17:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=n7P+0oLw; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2394980AbfJPVyX (ORCPT + 99 others); Wed, 16 Oct 2019 17:54:23 -0400 Received: from mail.kernel.org ([198.145.29.99]:43822 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2437693AbfJPVyK (ORCPT ); Wed, 16 Oct 2019 17:54:10 -0400 Received: from localhost (unknown [192.55.54.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A4E3D21D80; Wed, 16 Oct 2019 21:54:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571262850; bh=hZ0HwXvZLY2OjbIQp08AO4jHMdkynR0fd//Yhjwuk94=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n7P+0oLwWf2yAQIqDel8dJgcYjTjXGQkEYSSuPPFjW3XEWCtYm3T80fy9i1QEv4op 4KdZ/BFs4mKMKtuTqy15gpdMROl0C30f5NWM/KD24LkI7LoS5unK4SvU0F3sBkiraC yn6w3WG7VUaqWJXbFwtYvsgwWkjxmaMjp6KumdZ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jia-Ju Bai , Anna Schumaker , Sasha Levin Subject: [PATCH 4.9 16/92] fs: nfs: Fix possible null-pointer dereferences in encode_attrs() Date: Wed, 16 Oct 2019 14:49:49 -0700 Message-Id: <20191016214813.155757432@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191016214759.600329427@linuxfoundation.org> References: <20191016214759.600329427@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jia-Ju Bai [ Upstream commit e2751463eaa6f9fec8fea80abbdc62dbc487b3c5 ] In encode_attrs(), there is an if statement on line 1145 to check whether label is NULL: if (label && (attrmask[2] & FATTR4_WORD2_SECURITY_LABEL)) When label is NULL, it is used on lines 1178-1181: *p++ = cpu_to_be32(label->lfs); *p++ = cpu_to_be32(label->pi); *p++ = cpu_to_be32(label->len); p = xdr_encode_opaque_fixed(p, label->label, label->len); To fix these bugs, label is checked before being used. These bugs are found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai Signed-off-by: Anna Schumaker Signed-off-by: Sasha Levin --- fs/nfs/nfs4xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index 5e2724a928ed3..d7f8d5ce30e3e 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -1123,7 +1123,7 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, } else *p++ = cpu_to_be32(NFS4_SET_TO_SERVER_TIME); } - if (bmval[2] & FATTR4_WORD2_SECURITY_LABEL) { + if (label && (bmval[2] & FATTR4_WORD2_SECURITY_LABEL)) { *p++ = cpu_to_be32(label->lfs); *p++ = cpu_to_be32(label->pi); *p++ = cpu_to_be32(label->len); -- 2.20.1