Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21d33e35 authored by Fedor Pchelkin's avatar Fedor Pchelkin Committed by Greg Kroah-Hartman
Browse files

net: 9p: avoid freeing uninit memory in p9pdu_vreadf 



commit ff49bf1867578f23a5ffdd38f927f6e1e16796c4 upstream.

If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails,
the error path is not handled properly. *wnames or members of *wnames
array may be left uninitialized and invalidly freed.

Initialize *wnames to NULL in beginning of case 'T'. Initialize the first
*wnames array element to NULL and nullify the failing *wnames element so
that the error path freeing loop stops on the first NULL element and
doesn't proceed further.

Found by Linux Verification Center (linuxtesting.org).

Fixes: ace51c4d ("9p: add new protocol support code")
Signed-off-by: default avatarFedor Pchelkin <pchelkin@ispras.ru>
Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Reviewed-by: default avatarChristian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3abc53a6

net/9p/protocol.c

+13 −4
Original line number Original line Diff line number Diff line
@@ -243,6 +243,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, 
				uint16_t *nwname = va_arg(ap, uint16_t *);

				uint16_t *nwname = va_arg(ap, uint16_t *);

				char ***wnames = va_arg(ap, char ***);

				char ***wnames = va_arg(ap, char ***);





				*wnames = NULL;



				errcode = p9pdu_readf(pdu, proto_version,

				errcode = p9pdu_readf(pdu, proto_version,

								"w", nwname);

								"w", nwname);

				if (!errcode) {

				if (!errcode) {
@@ -251,6 +253,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, 
						    GFP_NOFS);

						    GFP_NOFS);

					if (!*wnames)

					if (!*wnames)

						errcode = -ENOMEM;

						errcode = -ENOMEM;

					else

						(*wnames)[0] = NULL;

				}

				}





				if (!errcode) {

				if (!errcode) {
@@ -262,22 +266,27 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, 
								proto_version,

								proto_version,

								"s",

								"s",

								&(*wnames)[i]);

								&(*wnames)[i]);

						if (errcode)

						if (errcode) {

							(*wnames)[i] = NULL;

							break;

							break;

						}

						}

					}

					}

				}





				if (errcode) {

				if (errcode) {

					if (*wnames) {

					if (*wnames) {

						int i;

						int i;





						for (i = 0; i < *nwname; i++)

						for (i = 0; i < *nwname; i++) {

							if (!(*wnames)[i])

								break;

							kfree((*wnames)[i]);

							kfree((*wnames)[i]);

						}

						}

						kfree(*wnames);

						kfree(*wnames);

						*wnames = NULL;

						*wnames = NULL;

					}

					}

				}

				}

			}

			break;

			break;

		case 'R':{

		case 'R':{

				uint16_t *nwqid = va_arg(ap, uint16_t *);

				uint16_t *nwqid = va_arg(ap, uint16_t *);