Commit ff49bf18 authored Dec 06, 2023 by Fedor Pchelkin Committed by Dominique Martinet Dec 13, 2023

net: 9p: avoid freeing uninit memory in p9pdu_vreadf



If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails,
the error path is not handled properly. *wnames or members of *wnames
array may be left uninitialized and invalidly freed.

Initialize *wnames to NULL in beginning of case 'T'. Initialize the first
*wnames array element to NULL and nullify the failing *wnames element so
that the error path freeing loop stops on the first NULL element and
doesn't proceed further.

Found by Linux Verification Center (linuxtesting.org).

Fixes: ace51c4d ("9p: add new protocol support code")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru>
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>

parent a931c681

net/9p/protocol.c

+13 −4

Original line number	Diff line number	Diff line
		@@ -394,6 +394,8 @@ p9pdu_vreadf(struct p9_fcall pdu, int proto_version, const char fmt,
		uint16_t nwname = va_arg(ap, uint16_t );
		char *wnames = va_arg(ap, char *);

		*wnames = NULL;

		errcode = p9pdu_readf(pdu, proto_version,
		"w", nwname);
		if (!errcode) {
		@@ -403,6 +405,8 @@ p9pdu_vreadf(struct p9_fcall pdu, int proto_version, const char fmt,
		GFP_NOFS);
		if (!*wnames)
		errcode = -ENOMEM;
		else
		(*wnames)[0] = NULL;
		}

		if (!errcode) {
		@@ -414,22 +418,27 @@ p9pdu_vreadf(struct p9_fcall pdu, int proto_version, const char fmt,
		proto_version,
		"s",
		&(*wnames)[i]);
		if (errcode)
		if (errcode) {
		(*wnames)[i] = NULL;
		break;
		}
		}
		}

		if (errcode) {
		if (*wnames) {
		int i;

		for (i = 0; i < *nwname; i++)
		for (i = 0; i < *nwname; i++) {
		if (!(*wnames)[i])
		break;
		kfree((*wnames)[i]);
		}
		kfree(*wnames);
		*wnames = NULL;
		}
		}
		}
		break;
		case 'R':{
		uint16_t nwqid = va_arg(ap, uint16_t );