korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 12:28:41 +08:00
Code Issues Packages Projects Releases Wiki Activity
67f34f093c
linux/net/9p
History
Fedor Pchelkin e5c15c3839 net: 9p: avoid freeing uninit memory in p9pdu_vreadf 
commit ff49bf1867 upstream.

If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails,
the error path is not handled properly. *wnames or members of *wnames
array may be left uninitialized and invalidly freed.

Initialize *wnames to NULL in beginning of case 'T'. Initialize the first
*wnames array element to NULL and nullify the failing *wnames element so
that the error path freeing loop stops on the first NULL element and
doesn't proceed further.

Found by Linux Verification Center (linuxtesting.org).

Fixes: ace51c4dd2 ("9p: add new protocol support code")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru>
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-08 11:27:36 +01:00
..
client.c net/9p: Initialize the iounit field during fid creation 2022-08-25 11:15:32 +02:00
error.c
Kconfig IB: Revert "remove redundant INFINIBAND kconfig dependencies" 2018-05-28 10:40:16 -06:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mod.c 9p: Use a slab for allocating requests 2019-07-03 13:14:41 +02:00
protocol.c net: 9p: avoid freeing uninit memory in p9pdu_vreadf 2024-01-08 11:27:36 +01:00
protocol.h
trans_common.c net/9p: include trans_common.h to fix missing prototype warning. 2019-07-03 13:14:43 +02:00
trans_common.h net/9p: remove (now-)unused helpers 2015-04-11 22:28:29 -04:00
trans_fd.c 9p/fd: Use P9_HDRSZ for header size 2022-12-14 11:28:25 +01:00
trans_rdma.c 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() 2023-03-11 16:31:59 +01:00
trans_virtio.c 9p: virtio: make sure 'offs' is initialized in zc_request 2023-09-23 10:47:57 +02:00
trans_xen.c 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 2023-04-20 12:04:40 +02:00
util.c 9p: fix whitespace issues 2018-08-13 09:34:58 +09:00