On Tue, Apr 04 2017, Kees Cook wrote:
> When the call to nfs_devname() fails, the error path attempts to retain
> the error via the mnt variable, but this requires a cast across very
> different types (char * to struct vfsmount), which the upcoming structure
> layout randomization plugin flags as being potentially dangerous in the
> face of randomization. This is a false positive, but what this code
> actually wants to do is retain the error value, so this patch explicitly
> sets it, instead of using what seems to be an unexpected cast.
>
> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
> ---
> fs/nfs/namespace.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
> index 786f17580582..89f50bf12f52 100644
> --- a/fs/nfs/namespace.c
> +++ b/fs/nfs/namespace.c
> @@ -259,9 +259,10 @@ struct vfsmount *nfs_do_submount(struct dentry *dentry, struct nfs_fh *fh,
> if (page == NULL)
> goto out;
> devname = nfs_devname(dentry, page, PAGE_SIZE);
> - mnt = (struct vfsmount *)devname;
> - if (IS_ERR(devname))
> + if (IS_ERR(devname)) {
> + mnt = ERR_PTR(PTR_ERR(devname));
Allow me to introduce you to ERR_CAST()
/**
* ERR_CAST - Explicitly cast an error-valued pointer to another pointer type
* @ptr: The pointer to cast.
*
* Explicitly cast an error-valued pointer to another pointer type in such a
* way as to make it clear that's what's going on.
*/
So:
+ mnt = ERR_CAST(devname);
NeilBrown
Attachment:
signature.asc
Description: PGP signature
