[PATCH 3.16.y-ckt 096/183] NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args

Luis Henriques luis.henriques at canonical.com
Fri Mar 6 09:56:27 UTC 2015

3.16.7-ckt8 -stable review patch.  If anyone has any objections, please let me know.


From: Trond Myklebust <trond.myklebust at primarydata.com>

commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream.

If the call to decode_rc_list() fails due to a memory allocation error,
then we need to truncate the array size to ensure that we only call
kfree() on those pointer that were allocated.

Reported-by: David Ramos <daramos at stanford.edu>
Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation")
Signed-off-by: Trond Myklebust <trond.myklebust at primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
 fs/nfs/callback_xdr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index f4ccfe6521ec..02f8d09e119f 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
 		for (i = 0; i < args->csa_nrclists; i++) {
 			status = decode_rc_list(xdr, &args->csa_rclists[i]);
-			if (status)
+			if (status) {
+				args->csa_nrclists = i;
 				goto out_free;
+			}
 	status = 0;

More information about the kernel-team mailing list