From: Kinglong Mee Date: Fri, 23 May 2014 11:57:49 +0000 (+0800) Subject: NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free() X-Git-Tag: omap-for-v3.16/fixes-against-rc1~67^2~27 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a1f05514b016aeaed638dbf677f443af7e7bde4f;p=pandora-kernel.git NFS4: Avoid NULL reference or double free in nfsd4_fslocs_free() If fsloc_parse() failed at kzalloc(), fs/nfsd/export.c 411 412 fsloc->locations = kzalloc(fsloc->locations_count 413 * sizeof(struct nfsd4_fs_location), GFP_KERNEL); 414 if (!fsloc->locations) 415 return -ENOMEM; svc_export_parse() will call nfsd4_fslocs_free() with fsloc->locations = NULL, so that, "kfree(fsloc->locations[i].path);" will cause a crash. If fsloc_parse() failed after that, fsloc_parse() will call nfsd4_fslocs_free(), and svc_export_parse() will call it again, so that, a double free is caused. This patch checks the fsloc->locations, and set to NULL after it be freed. Signed-off-by: Kinglong Mee Signed-off-by: J. Bruce Fields --- Reading git-diff-tree failed