Commit 668668f1 authored by Hangyu Hua's avatar Hangyu Hua Committed by sanglipeng
Browse files

9p/net: fix possible memory leak in p9_check_errors() 

stable inclusion
from stable-v5.10.206
commit 1e2db0124c695b11e5c522d87f6ca329e608a897
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9O5W8

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1e2db0124c695b11e5c522d87f6ca329e608a897



--------------------------------

commit ce07087964208eee2ca2f9ee4a98f8b5d9027fe6 upstream.

When p9pdu_readf() is called with "s?d" attribute, it allocates a pointer
that will store a string. But when p9pdu_readf() fails while handling "d"
then this pointer will not be freed in p9_check_errors().

Fixes: 51a87c55 ("9p: rework client code to use new protocol support functions")
Reviewed-by: default avatarChristian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Message-ID: <20231027030302.11927-1-hbh25y@gmail.com>
Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218235


Signed-off-by: default avatarAlexey Panov <apanov@astralinux.ru>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 51460abe

net/9p/client.c

+5 −2
Original line number Diff line number Diff line
@@ -520,11 +520,14 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req) 
		return 0;



	if (!p9_is_proto_dotl(c)) {

		char *ename;

		char *ename = NULL;



		err = p9pdu_readf(&req->rc, c->proto_version, "s?d",

				  &ename, &ecode);

		if (err)

		if (err) {

			kfree(ename);

			goto out_err;

		}



		if (p9_is_proto_dotu(c) && ecode < 512)

			err = -ecode;