From 50192abe02929586111fb33f216060a9341875f1 Mon Sep 17 00:00:00 2001 From: Will Deacon Date: Wed, 21 Aug 2013 18:24:47 +0100 Subject: fs/9p: avoid accessing utsname after namespace has been torn down During trinity fuzzing in a kvmtool guest, I stumbled across the following: Unable to handle kernel NULL pointer dereference at virtual address 00000004 PC is at v9fs_file_do_lock+0xc8/0x1a0 LR is at v9fs_file_do_lock+0x48/0x1a0 [] (v9fs_file_do_lock+0xc8/0x1a0) from [] (locks_remove_flock+0x8c/0x124) [] (locks_remove_flock+0x8c/0x124) from [] (__fput+0x58/0x1e4) [] (__fput+0x58/0x1e4) from [] (task_work_run+0xac/0xe8) [] (task_work_run+0xac/0xe8) from [] (do_exit+0x6bc/0x8d8) [] (do_exit+0x6bc/0x8d8) from [] (do_group_exit+0x3c/0xb0) [] (do_group_exit+0x3c/0xb0) from [] (__wake_up_parent+0x0/0x18) I believe this is due to an attempt to access utsname()->nodename, after exit_task_namespaces() has been called, leaving current->nsproxy->uts_ns as NULL and causing the above dereference. A similar issue was fixed for lockd in 9a1b6bf818e7 ("LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs"), so this patch attempts something similar for 9pfs. Cc: Eric Van Hensbergen Cc: Ron Minnich Cc: Latchesar Ionkov Cc: Trond Myklebust Signed-off-by: Will Deacon Signed-off-by: Eric Van Hensbergen --- net/9p/client.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'net/9p') diff --git a/net/9p/client.c b/net/9p/client.c index 8b93cae2d11d..0e49b288e574 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -992,6 +992,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) { int err; struct p9_client *clnt; + char *client_id; err = 0; clnt = kmalloc(sizeof(struct p9_client), GFP_KERNEL); @@ -1000,6 +1001,10 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) clnt->trans_mod = NULL; clnt->trans = NULL; + + client_id = utsname()->nodename; + memcpy(clnt->name, client_id, strlen(client_id) + 1); + spin_lock_init(&clnt->lock); INIT_LIST_HEAD(&clnt->fidlist); -- cgit v1.2.3-59-g8ed1b