Commit 7569b7e7 authored by Johannes Berg's avatar Johannes Berg Committed by Tong Tiangen
Browse files

um: line: always fill *error_out in setup_one_line() 

stable inclusion
from stable-v5.10.226
commit c8944d449fda9f58c03bd99649b2df09948fc874
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NH
CVE: CVE-2024-46844

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c8944d449fda9f58c03bd99649b2df09948fc874

--------------------------------

[ Upstream commit 824ac4a5edd3f7494ab1996826c4f47f8ef0f63d ]

The pointer isn't initialized by callers, but I have
encountered cases where it's still printed; initialize
it in all possible cases in setup_one_line().

Link: https://patch.msgid.link/20240703172235.ad863568b55f.Iaa1eba4db8265d7715ba71d5f6bb8c7ff63d27e9@changeid


Acked-By: default avatarAnton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarTong Tiangen <tongtiangen@huawei.com>
parent 313516d1

arch/um/drivers/line.c

+2 −0
Original line number Diff line number Diff line
@@ -378,6 +378,7 @@ int setup_one_line(struct line *lines, int n, char *init, 
			parse_chan_pair(NULL, line, n, opts, error_out);

			err = 0;

		}

		*error_out = "configured as 'none'";

	} else {

		char *new = kstrdup(init, GFP_KERNEL);

		if (!new) {
@@ -401,6 +402,7 @@ int setup_one_line(struct line *lines, int n, char *init, 
			}

		}

		if (err) {

			*error_out = "failed to parse channel pair";

			line->init_str = NULL;

			line->valid = 0;

			kfree(new);