queue-4.19/cifs-fix-null-pointer-dereference-of-devname.patch

   1 From 058f8e47562016bf71b47c9d9c9143d30902f95b Mon Sep 17 00:00:00 2001
   2 From: Yao Liu <yotta.liu@ucloud.cn>
   3 Date: Mon, 28 Jan 2019 19:47:28 +0800
   4 Subject: cifs: Fix NULL pointer dereference of devname
   5
   6 [ Upstream commit 68e2672f8fbd1e04982b8d2798dd318bf2515dd2 ]
   7
   8 There is a NULL pointer dereference of devname in strspn()
   9
  10 The oops looks something like:
  11
  12   CIFS: Attempting to mount (null)
  13   BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
  14   ...
  15   RIP: 0010:strspn+0x0/0x50
  16   ...
  17   Call Trace:
  18    ? cifs_parse_mount_options+0x222/0x1710 [cifs]
  19    ? cifs_get_volume_info+0x2f/0x80 [cifs]
  20    cifs_setup_volume_info+0x20/0x190 [cifs]
  21    cifs_get_volume_info+0x50/0x80 [cifs]
  22    cifs_smb3_do_mount+0x59/0x630 [cifs]
  23    ? ida_alloc_range+0x34b/0x3d0
  24    cifs_do_mount+0x11/0x20 [cifs]
  25    mount_fs+0x52/0x170
  26    vfs_kern_mount+0x6b/0x170
  27    do_mount+0x216/0xdc0
  28    ksys_mount+0x83/0xd0
  29    __x64_sys_mount+0x25/0x30
  30    do_syscall_64+0x65/0x220
  31    entry_SYSCALL_64_after_hwframe+0x49/0xbe
  32
  33 Fix this by adding a NULL check on devname in cifs_parse_devname()
  34
  35 Signed-off-by: Yao Liu <yotta.liu@ucloud.cn>
  36 Signed-off-by: Steve French <stfrench@microsoft.com>
  37 Signed-off-by: Sasha Levin <sashal@kernel.org>
  38 ---
  39  fs/cifs/connect.c | 5 +++++
  40  1 file changed, 5 insertions(+)
  41
  42 diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
  43 index a5ea742654aa..f31339db45fd 100644
  44 --- a/fs/cifs/connect.c
  45 +++ b/fs/cifs/connect.c
  46 @@ -1347,6 +1347,11 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol)
  47         const char *delims = "/\\";
  48         size_t len;
  49
  50 +       if (unlikely(!devname || !*devname)) {
  51 +               cifs_dbg(VFS, "Device name not specified.\n");
  52 +               return -EINVAL;
  53 +       }
  54 +
  55         /* make sure we have a valid UNC double delimiter prefix */
  56         len = strspn(devname, delims);
  57         if (len != 2)
  58 --
  59 2.19.1
  60