Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4579a1ba authored by Anton Ivanov's avatar Anton Ivanov Committed by Richard Weinberger
Browse files

um: Fix initialization of vector queues 



UML vector drivers could derefence uninitialized memory
when cleaning up after a queue allocation failure.

Fixes: 49da7e64 ("High Performance UML Vector Network Driver")
Cc: <stable@vger.kernel.org>
Reported-by: default avatarDan Capenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAnton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent cca76c1a

arch/um/drivers/vector_kern.c

+12 −3
Original line number Diff line number Diff line
@@ -504,15 +504,19 @@ static struct vector_queue *create_queue( 


	result = kmalloc(sizeof(struct vector_queue), GFP_KERNEL);

	if (result == NULL)

		goto out_fail;

		return NULL;

	result->max_depth = max_size;

	result->dev = vp->dev;

	result->mmsg_vector = kmalloc(

		(sizeof(struct mmsghdr) * max_size), GFP_KERNEL);

	if (result->mmsg_vector == NULL)

		goto out_mmsg_fail;

	result->skbuff_vector = kmalloc(

		(sizeof(void *) * max_size), GFP_KERNEL);

	if (result->mmsg_vector == NULL || result->skbuff_vector == NULL)

		goto out_fail;

	if (result->skbuff_vector == NULL)

		goto out_skb_fail;



	/* further failures can be handled safely by destroy_queue*/



	mmsg_vector = result->mmsg_vector;

	for (i = 0; i < max_size; i++) {
@@ -563,6 +567,11 @@ static struct vector_queue *create_queue( 
	result->head = 0;

	result->tail = 0;

	return result;

out_skb_fail:

	kfree(result->mmsg_vector);

out_mmsg_fail:

	kfree(result);

	return NULL;

out_fail:

	destroy_queue(result);

	return NULL;