| Message ID | 20200122010756.30245-1-lsahlber@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | cifs: fix NULL dereference in match_prepath | expand |
merged into cifs-2.6.git for-next On Tue, Jan 21, 2020 at 7:08 PM Ronnie Sahlberg <lsahlber@redhat.com> wrote: > > RHBZ: 1760879 > > Fix an oops in match_prepath() by making sure that the prepath string is not > NULL before we pass it into strcmp(). > > This is similar to other checks we make for example in cifs_root_iget() > > Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com> > --- > fs/cifs/connect.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c > index 05ea0e2b7e0e..0aa3623ae0e1 100644 > --- a/fs/cifs/connect.c > +++ b/fs/cifs/connect.c > @@ -3709,8 +3709,10 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data) > { > struct cifs_sb_info *old = CIFS_SB(sb); > struct cifs_sb_info *new = mnt_data->cifs_sb; > - bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH; > - bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH; > + bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) && > + old->prepath; > + bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) && > + new->prepath; > > if (old_set && new_set && !strcmp(new->prepath, old->prepath)) > return 1; > -- > 2.13.6 >
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 05ea0e2b7e0e..0aa3623ae0e1 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3709,8 +3709,10 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data) { struct cifs_sb_info *old = CIFS_SB(sb); struct cifs_sb_info *new = mnt_data->cifs_sb; - bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH; - bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH; + bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) && + old->prepath; + bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) && + new->prepath; if (old_set && new_set && !strcmp(new->prepath, old->prepath)) return 1;
RHBZ: 1760879 Fix an oops in match_prepath() by making sure that the prepath string is not NULL before we pass it into strcmp(). This is similar to other checks we make for example in cifs_root_iget() Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com> --- fs/cifs/connect.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)