From: Paulo Alcantara pc@cjr.nz
stable inclusion from stable-5.10.53 commit e58c162789becede894d3e94c0ce6695a2ef5796 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4EC CVE: CVE-2021-47307
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 03313d1c3a2f086bb60920607ab79ac8f8578306 ]
The optional @ref parameter might contain an NULL node_name, so prevent dereferencing it in cifs_compose_mount_options().
Addresses-Coverity: 1476408 ("Explicit null dereferenced") Signed-off-by: Paulo Alcantara (SUSE) pc@cjr.nz Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Sasha Levin sashal@kernel.org
Conflicts: fs/cifs/cifs_dfs_ref.c [5739375ee423 ("cifs: Fix mount options set in automount") is not merged.] Signed-off-by: Baokun Li libaokun1@huawei.com --- fs/cifs/cifs_dfs_ref.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c index 563e2f6268c3..dc1b654a80ad 100644 --- a/fs/cifs/cifs_dfs_ref.c +++ b/fs/cifs/cifs_dfs_ref.c @@ -151,6 +151,9 @@ char *cifs_compose_mount_options(const char *sb_mountdata, if (sb_mountdata == NULL) return ERR_PTR(-EINVAL);
+ if (WARN_ON_ONCE(!ref->node_name || ref->path_consumed < 0)) + return ERR_PTR(-EINVAL); + if (strlen(fullpath) - ref->path_consumed) { prepath = fullpath + ref->path_consumed; /* skip initial delimiter */