diff options
| author | Yao Liu <yotta.liu@ucloud.cn> | 2019-01-28 19:47:28 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-04-05 22:29:07 +0200 |
| commit | 9d5a48f12e4848b1f855a2046797ba214ade92c7 (patch) | |
| tree | 548b6718f19913c09d4eddd7fcf41017b882d3f4 /fs | |
| parent | 83d6849eb1188b69cc5325a0f8f033f3a595c950 (diff) | |
| download | linux-stable-9d5a48f12e4848b1f855a2046797ba214ade92c7.tar.gz linux-stable-9d5a48f12e4848b1f855a2046797ba214ade92c7.tar.bz2 linux-stable-9d5a48f12e4848b1f855a2046797ba214ade92c7.zip | |
cifs: Fix NULL pointer dereference of devname
[ Upstream commit 68e2672f8fbd1e04982b8d2798dd318bf2515dd2 ]
There is a NULL pointer dereference of devname in strspn()
The oops looks something like:
CIFS: Attempting to mount (null)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
...
RIP: 0010:strspn+0x0/0x50
...
Call Trace:
? cifs_parse_mount_options+0x222/0x1710 [cifs]
? cifs_get_volume_info+0x2f/0x80 [cifs]
cifs_setup_volume_info+0x20/0x190 [cifs]
cifs_get_volume_info+0x50/0x80 [cifs]
cifs_smb3_do_mount+0x59/0x630 [cifs]
? ida_alloc_range+0x34b/0x3d0
cifs_do_mount+0x11/0x20 [cifs]
mount_fs+0x52/0x170
vfs_kern_mount+0x6b/0x170
do_mount+0x216/0xdc0
ksys_mount+0x83/0xd0
__x64_sys_mount+0x25/0x30
do_syscall_64+0x65/0x220
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this by adding a NULL check on devname in cifs_parse_devname()
Signed-off-by: Yao Liu <yotta.liu@ucloud.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/cifs/connect.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 33e65b71c49a..f291ed0c155d 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1201,6 +1201,11 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol) const char *delims = "/\\"; size_t len; + if (unlikely(!devname || !*devname)) { + cifs_dbg(VFS, "Device name not specified.\n"); + return -EINVAL; + } + /* make sure we have a valid UNC double delimiter prefix */ len = strspn(devname, delims); if (len != 2) |