NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: kern/38336: NULL deref in nfs_lookup

The following reply was made to PR kern/38336; it has been noted by GNATS.

From: (YAMAMOTO Takashi)
Subject: Re: kern/38336: NULL deref in nfs_lookup
Date: Sun, 30 Mar 2008 22:55:03 +0900 (JST)

 > nfs_vnops.c:
 >     925      nfsm_request(np, NFSPROC_LOOKUP, curlwp, cnp->cn_cred);
 >     926      if (error) {
 >     927              nfsm_postop_attr(dvp, attrflag, 0);
 >     928              m_freem(mrep);
 >     929              goto nfsmout;
 >     930      }
 > nfsm_request() fills 'error' and typically 'md'. In case of error,
 > 'md' is sometimes not filled and can contain junk from the stack,
 > but nfsm_postop_attr() assumes that 'md' is always filled. Here is 
 can you be specific about "sometimes"?
 unless NFSERR_RETERR is set, nfsm_request macro itself does "goto nfsmout"
 so "if (error)" in the above code is not executed.

Home | Main Index | Thread Index | Old Index