Commit fc601477 authored by Chuck Lever's avatar Chuck Lever Committed by Trond Myklebust

NFS: Address memory leaks in the NFS client mount option parser

David Howells noticed that repeating the same mount option twice during an
NFS mount request can result in orphaned memory in certain cases.

Only the client_address and mount_server.hostname strings are initialized
in the mount parsing loop, so those appear to be the only two pointers that
might be written over by repeating a mount option.  The strings in the
nfs_server section of the nfs_parsed_mount_data structure are set only once
after the options are parsed, thus these are not susceptible to being
overwritten.
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 3d1c5508
...@@ -1006,12 +1006,14 @@ static int nfs_parse_mount_options(char *raw, ...@@ -1006,12 +1006,14 @@ static int nfs_parse_mount_options(char *raw,
string = match_strdup(args); string = match_strdup(args);
if (string == NULL) if (string == NULL)
goto out_nomem; goto out_nomem;
kfree(mnt->client_address);
mnt->client_address = string; mnt->client_address = string;
break; break;
case Opt_mounthost: case Opt_mounthost:
string = match_strdup(args); string = match_strdup(args);
if (string == NULL) if (string == NULL)
goto out_nomem; goto out_nomem;
kfree(mnt->mount_server.hostname);
mnt->mount_server.hostname = string; mnt->mount_server.hostname = string;
break; break;
case Opt_mountaddr: case Opt_mountaddr:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment