Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-12-29 09:16:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

net: 9p: avoid freeing uninit memory in p9pdu_vreadf

Browse Source 
If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails,
the error path is not handled properly. *wnames or members of *wnames
array may be left uninitialized and invalidly freed.

Initialize *wnames to NULL in beginning of case 'T'. Initialize the first
*wnames array element to NULL and nullify the failing *wnames element so
that the error path freeing loop stops on the first NULL element and
doesn't proceed further.

Found by Linux Verification Center (linuxtesting.org).

Fixes: ace51c4dd2 ("9p: add new protocol support code")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru>
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
This commit is contained in:
Fedor Pchelkin 2023-12-06 23:09:13 +03:00 committed by Dominique Martinet
parent a931c68160
commit ff49bf1867
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/9p/protocol.c
View File

@ -394,6 +394,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
uint16_t *nwname = va_arg(ap, uint16_t *);
char ***wnames = va_arg(ap, char ***);
*wnames = NULL;
errcode = p9pdu_readf(pdu, proto_version,
"w", nwname);
if (!errcode) {
@ -403,6 +405,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
GFP_NOFS);
if (!*wnames)
errcode = -ENOMEM;
else
(*wnames)[0] = NULL;
}
if (!errcode) {
@ -414,22 +418,27 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
proto_version,
"s",
&(*wnames)[i]);
if (errcode)
if (errcode) {
(*wnames)[i] = NULL;
break;
}
}
}
if (errcode) {
if (*wnames) {
int i;
for (i = 0; i < *nwname; i++)
for (i = 0; i < *nwname; i++) {
if (!(*wnames)[i])
break;
kfree((*wnames)[i]);
}
kfree(*wnames);
*wnames = NULL;
}
}
}
break;
case 'R':{
uint16_t *nwqid = va_arg(ap, uint16_t *);