Fedor Pchelkin 21d33e353f net: 9p: avoid freeing uninit memory in p9pdu_vreadf ... commit ff49bf1867 upstream. If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails, the error path is not handled properly. *wnames or members of *wnames array may be left uninitialized and invalidly freed. Initialize *wnames to NULL in beginning of case 'T'. Initialize the first *wnames array element to NULL and nullify the failing *wnames element so that the error path freeing loop stops on the first NULL element and doesn't proceed further. Found by Linux Verification Center (linuxtesting.org). Fixes: ace51c4dd2 ("9p: add new protocol support code") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru> Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-01-08 11:25:04 +01:00
..
client.c	net/9p: Initialize the iounit field during fid creation	2022-08-25 11:11:30 +02:00
error.c
Kconfig	xen/9pfs: select CONFIG_XEN_XENBUS_FRONTEND	2017-05-02 11:14:36 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mod.c
protocol.c	net: 9p: avoid freeing uninit memory in p9pdu_vreadf	2024-01-08 11:25:04 +01:00
protocol.h
trans_common.c	net/9p: include trans_common.h to fix missing prototype warning.	2019-07-03 13:15:59 +02:00
trans_common.h	net/9p: remove (now-)unused helpers	2015-04-11 22:28:29 -04:00
trans_fd.c	net/9p: Fix a potential socket leak in p9_socket_open	2022-12-08 11:16:32 +01:00
trans_rdma.c	9p/rdma: remove useless check in cm_event_handler	2019-07-03 13:15:58 +02:00
trans_virtio.c	9p: virtio: make sure 'offs' is initialized in zc_request	2023-09-23 10:46:52 +02:00
trans_xen.c	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-20 12:02:11 +02:00
util.c