Commit d9060742fbf630fe31951dfc10b798deb2813f01
Committed by
Linus Torvalds
1 parent
1fac1fa965
Exists in
master
and in
16 other branches
ocfs2: check if cluster name exists before deref
Commit c74a3bdd9b52 ("ocfs2: add clustername to cluster connection") is trying to strlcpy a string which was explicitly passed as NULL in the very same patch, triggering a NULL ptr deref. BUG: unable to handle kernel NULL pointer dereference at (null) IP: strlcpy (lib/string.c:388 lib/string.c:151) CPU: 19 PID: 19426 Comm: trinity-c19 Tainted: G W 3.14.0-rc7-next-20140325-sasha-00014-g9476368-dirty #274 RIP: strlcpy (lib/string.c:388 lib/string.c:151) Call Trace: ocfs2_cluster_connect (fs/ocfs2/stackglue.c:350) ocfs2_cluster_connect_agnostic (fs/ocfs2/stackglue.c:396) user_dlm_register (fs/ocfs2/dlmfs/userdlm.c:679) dlmfs_mkdir (fs/ocfs2/dlmfs/dlmfs.c:503) vfs_mkdir (fs/namei.c:3467) SyS_mkdirat (fs/namei.c:3488 fs/namei.c:3472) tracesys (arch/x86/kernel/entry_64.S:749) akpm: this patch probably disables the feature. A temporary thing to avoid triviel oopses. Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Cc: Goldwyn Rodrigues <rgoldwyn@suse.com> Cc: Mark Fasheh <mfasheh@suse.de> Cc: Joel Becker <jlbec@evilplan.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 1 changed file with 3 additions and 1 deletions Side-by-side Diff
fs/ocfs2/stackglue.c
... | ... | @@ -346,7 +346,9 @@ |
346 | 346 | |
347 | 347 | strlcpy(new_conn->cc_name, group, GROUP_NAME_MAX + 1); |
348 | 348 | new_conn->cc_namelen = grouplen; |
349 | - strlcpy(new_conn->cc_cluster_name, cluster_name, CLUSTER_NAME_MAX + 1); | |
349 | + if (cluster_name_len) | |
350 | + strlcpy(new_conn->cc_cluster_name, cluster_name, | |
351 | + CLUSTER_NAME_MAX + 1); | |
350 | 352 | new_conn->cc_cluster_name_len = cluster_name_len; |
351 | 353 | new_conn->cc_recovery_handler = recovery_handler; |
352 | 354 | new_conn->cc_recovery_data = recovery_data; |