netdev - nfs41: potential null deref in xprt_reserve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100423120013.GF29093@bicker>
Date:	Fri, 23 Apr 2010 14:00:13 +0200
From:	Dan Carpenter <error27@...il.com>
To:	iyer@...app.com
Cc:	linux-nfs@...r.kernel.org, netdev@...r.kernel.org
Subject: nfs41: potential null deref in xprt_reserve_xprt()?

I'm going through some Smatch results and had a question.  

Until commit 343952fa5a: "nfs41: Get the rpc_xprt * from the rpc_rqst 
instead of the rpc_clnt." we assumed that "task->tk_rqstp" can be NULL.  
But that patch dereferences it unconditionally.

diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 0eea2bf..c144611 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -195,8 +195,8 @@ EXPORT_SYMBOL_GPL(xprt_load_transport);
  */
 int xprt_reserve_xprt(struct rpc_task *task)
 {
-       struct rpc_xprt *xprt = task->tk_xprt;
        struct rpc_rqst *req = task->tk_rqstp;
+       struct rpc_xprt *xprt = req->rq_xprt;
	                        ^^^^^^^^^^^^^

Can "req" be null here?  The patch is a year old, so presumably it
isn't null very often.

If you would like, I can remove the checks for null from the rest of the
function.

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html