linux-kernel - Re: Patch "NFSD fixing possible null pointer derefering in copy offload" has been added to the 5.5-stable tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 15 Mar 2020 09:20:36 +0100
From:   Greg KH <greg@...ah.com>
To:     linux-kernel@...r.kernel.org
Cc:     olga.kornievskaia@...il.com, stable-commits@...r.kernel.org
Subject: Re: Patch "NFSD fixing possible null pointer derefering in copy
 offload" has been added to the 5.5-stable tree

On Fri, Mar 13, 2020 at 08:35:22PM -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
> 
>     NFSD fixing possible null pointer derefering in copy offload
> 
> to the 5.5-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> The filename of the patch is:
>      nfsd-fixing-possible-null-pointer-derefering-in-copy.patch
> and it can be found in the queue-5.5 subdirectory.
> 
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@...r.kernel.org> know about it.
> 
> 
> 
> commit a264e7b209f248f59b4fee0d1ed3fbde014a942e
> Author: Olga Kornievskaia <olga.kornievskaia@...il.com>
> Date:   Wed Dec 4 15:13:54 2019 -0500
> 
>     NFSD fixing possible null pointer derefering in copy offload
>     
>     [ Upstream commit 2e577f0faca4640348c398cb85d60a1eedac4b1e ]
>     
>     Static checker revealed possible error path leading to possible
>     NULL pointer dereferencing.
>     
>     Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
>     Fixes: e0639dc5805a: ("NFSD introduce async copy feature")
>     Signed-off-by: Olga Kornievskaia <kolga@...app.com>
>     Signed-off-by: J. Bruce Fields <bfields@...hat.com>
>     Signed-off-by: Sasha Levin <sashal@...nel.org>
> 
> diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
> index 4798667af647c..91b64c15556e6 100644
> --- a/fs/nfsd/nfs4proc.c
> +++ b/fs/nfsd/nfs4proc.c
> @@ -1223,7 +1223,8 @@ static void cleanup_async_copy(struct nfsd4_copy *copy)
>  {
>  	nfs4_free_cp_state(copy);
>  	nfsd_file_put(copy->nf_dst);
> -	nfsd_file_put(copy->nf_src);
> +	if (copy->cp_intra)
> +		nfsd_file_put(copy->nf_src);
>  	spin_lock(&copy->cp_clp->async_lock);
>  	list_del(&copy->copies);
>  	spin_unlock(&copy->cp_clp->async_lock);

This breaks the build here, and in 5.4, so I'll go drop it from both
trees :(

thanks,

greg k-h