[PATCH] Fix for possible null pointer dereference in auth.c

Subsystems: kernel nfsd, sunrpc, and lockd servers, networking [general], nfs, sunrpc, and lockd clients, the rest

STALE4497d

6 messages, 3 authors, 2014-05-17 · open the first message on its own page

[PATCH] Fix for possible null pointer dereference in auth.c

From: Rickard Strandqvist <hidden>
Date: 2014-05-15 21:55:57

There is otherwise a risk of a possible null pointer dereference.

Was largely found by using a static code analysis program called cppcheck.

Signed-off-by: Rickard Strandqvist <redacted>
---
 net/sunrpc/auth.c |   10 +++++++---
 1 fil ändrad, 7 tillägg(+), 3 borttagningar(-)

diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 5285ead..3a55698 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c

@@ -801,10 +801,14 @@ rpcauth_invalcred(struct rpc_task *task)
 {
 	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
 
-	dprintk("RPC: %5u invalidating %s cred %p\n",
-		task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
-	if (cred)
+	if (cred) {
+		dprintk("RPC: %5u invalidating %s cred %p\n",
+			task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
+
 		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+	}
+	else
+		dprintk("RPC: %5u invalidating is NULL\n", task->tk_pid);
 }
 
 int

-- 
1.7.10.4

Re: [PATCH] Fix for possible null pointer dereference in auth.c

From: Trond Myklebust <hidden>
Date: 2014-05-15 22:07:04

On Thu, May 15, 2014 at 5:56 PM, Rickard Strandqvist
[off-list ref] wrote:

quoted hunk

There is otherwise a risk of a possible null pointer dereference.

Was largely found by using a static code analysis program called cppcheck.

Signed-off-by: Rickard Strandqvist <redacted>
---
 net/sunrpc/auth.c |   10 +++++++---
 1 fil ändrad, 7 tillägg(+), 3 borttagningar(-)

diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 5285ead..3a55698 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c

@@ -801,10 +801,14 @@ rpcauth_invalcred(struct rpc_task *task)
 {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;

-       dprintk("RPC: %5u invalidating %s cred %p\n",
-               task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
-       if (cred)
+       if (cred) {
+               dprintk("RPC: %5u invalidating %s cred %p\n",
+                       task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
+
                clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+       }
+       else
+               dprintk("RPC: %5u invalidating is NULL\n", task->tk_pid);
 }

Can you please explain how we can get to rpcauth_invalcred() without a
valid cred pointer? I'm not seeing it...

Cheers
  Trond
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] Fix for possible null pointer dereference in auth.c

From: Rickard Strandqvist <hidden>
Date: 2014-05-15 22:10:56

Hi

I do not know, I'm not an expert on this code.
But since there before was a if (cred) someone must have thought this
could happen.

Best regards
Rickard Strandqvist


2014-05-16 0:07 GMT+02:00 Trond Myklebust [off-list ref]:

On Thu, May 15, 2014 at 5:56 PM, Rickard Strandqvist
[off-list ref] wrote:

quoted

There is otherwise a risk of a possible null pointer dereference.

Was largely found by using a static code analysis program called cppcheck.

Signed-off-by: Rickard Strandqvist <redacted>
---
 net/sunrpc/auth.c |   10 +++++++---
 1 fil ändrad, 7 tillägg(+), 3 borttagningar(-)

diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 5285ead..3a55698 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c

@@ -801,10 +801,14 @@ rpcauth_invalcred(struct rpc_task *task)
 {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;

-       dprintk("RPC: %5u invalidating %s cred %p\n",
-               task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
-       if (cred)
+       if (cred) {
+               dprintk("RPC: %5u invalidating %s cred %p\n",
+                       task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
+
                clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+       }
+       else
+               dprintk("RPC: %5u invalidating is NULL\n", task->tk_pid);
 }

Can you please explain how we can get to rpcauth_invalcred() without a
valid cred pointer? I'm not seeing it...

Cheers
  Trond

Re: [PATCH] Fix for possible null pointer dereference in auth.c

From: Sergei Shtylyov <hidden>
Date: 2014-05-16 12:19:39

Hello.

On 16-05-2014 1:56, Rickard Strandqvist wrote:

There is otherwise a risk of a possible null pointer dereference.

Was largely found by using a static code analysis program called cppcheck.

Signed-off-by: Rickard Strandqvist <redacted>
---
  net/sunrpc/auth.c |   10 +++++++---
  1 fil ändrad, 7 tillägg(+), 3 borttagningar(-)

quoted hunk

diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 5285ead..3a55698 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c

@@ -801,10 +801,14 @@ rpcauth_invalcred(struct rpc_task *task)
  {
  	struct rpc_cred *cred = task->tk_rqstp->rq_cred;

-	dprintk("RPC: %5u invalidating %s cred %p\n",
-		task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
-	if (cred)
+	if (cred) {
+		dprintk("RPC: %5u invalidating %s cred %p\n",
+			task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
+
  		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+	}
+	else

    } and *else* should be on the same line, and there should be {} in the 
*else* arm since there's {} in the *if* arm already, according to 
Documentation/CodingStyle.

+		dprintk("RPC: %5u invalidating is NULL\n", task->tk_pid);

    That's not a proper English, I'm afraid.

WBR, Sergei

Re: [PATCH] Fix for possible null pointer dereference in auth.c

From: Rickard Strandqvist <hidden>
Date: 2014-05-17 16:36:16

Hi

I have made a new patch according Sergei specification.

But there remains Tronds question though.

Best regards
Rickard Strandqvist


2014-05-16 14:19 GMT+02:00 Sergei Shtylyov [off-list ref]:

Hello.


On 16-05-2014 1:56, Rickard Strandqvist wrote:

quoted

There is otherwise a risk of a possible null pointer dereference.

quoted

Was largely found by using a static code analysis program called cppcheck.

quoted

Signed-off-by: Rickard Strandqvist
[off-list ref]
---
  net/sunrpc/auth.c |   10 +++++++---
  1 fil ändrad, 7 tillägg(+), 3 borttagningar(-)

quoted

diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 5285ead..3a55698 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c

@@ -801,10 +801,14 @@ rpcauth_invalcred(struct rpc_task *task)
  {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;

-       dprintk("RPC: %5u invalidating %s cred %p\n",
-               task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
-       if (cred)
+       if (cred) {
+               dprintk("RPC: %5u invalidating %s cred %p\n",
+                       task->tk_pid, cred->cr_auth->au_ops->au_name,

cred);
+
                clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+       }
+       else


   } and *else* should be on the same line, and there should be {} in the
*else* arm since there's {} in the *if* arm already, according to
Documentation/CodingStyle.

quoted

+               dprintk("RPC: %5u invalidating is NULL\n", task->tk_pid);


   That's not a proper English, I'm afraid.

quoted


WBR, Sergei

Re: [PATCH] Fix for possible null pointer dereference in auth.c

From: Trond Myklebust <hidden>
Date: 2014-05-17 17:17:32

On Sat, May 17, 2014 at 12:36 PM, Rickard Strandqvist
[off-list ref] wrote:

Hi

I have made a new patch according Sergei specification.

I'll be happy to apply this patch once someone explains to me why we
can't just remove that check for cred != NULL, however I'm not
applying a patch purely in order to silence a warning from cppcheck.

Cheers,
   Trond

But there remains Tronds question though.

Best regards
Rickard Strandqvist


2014-05-16 14:19 GMT+02:00 Sergei Shtylyov [off-list ref]:

quoted

Hello.


On 16-05-2014 1:56, Rickard Strandqvist wrote:

quoted

There is otherwise a risk of a possible null pointer dereference.

quoted

Was largely found by using a static code analysis program called cppcheck.

quoted

Signed-off-by: Rickard Strandqvist
[off-list ref]
---
  net/sunrpc/auth.c |   10 +++++++---
  1 fil ändrad, 7 tillägg(+), 3 borttagningar(-)

quoted

diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 5285ead..3a55698 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c

@@ -801,10 +801,14 @@ rpcauth_invalcred(struct rpc_task *task)
  {
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;

-       dprintk("RPC: %5u invalidating %s cred %p\n",
-               task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
-       if (cred)
+       if (cred) {
+               dprintk("RPC: %5u invalidating %s cred %p\n",
+                       task->tk_pid, cred->cr_auth->au_ops->au_name,

cred);
+
                clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+       }
+       else


   } and *else* should be on the same line, and there should be {} in the
*else* arm since there's {} in the *if* arm already, according to
Documentation/CodingStyle.

quoted

+               dprintk("RPC: %5u invalidating is NULL\n", task->tk_pid);


   That's not a proper English, I'm afraid.

quoted


WBR, Sergei



-- 
Trond Myklebust

Linux NFS client maintainer, PrimaryData

trond.myklebust-7I+n7zu2hftEKMMhf/gKZA@public.gmane.org
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help