net: 9p: avoid freeing uninit memory in p9pdu_vreadf
commit ff49bf18 upstream. If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails, the error path is not handled properly. *wnames or members of *wnames array may be left uninitialized and invalidly freed. Initialize *wnames to NULL in beginning of case 'T'. Initialize the first *wnames array element to NULL and nullify the failing *wnames element so that the error path freeing loop stops on the first NULL element and doesn't proceed further. Found by Linux Verification Center (linuxtesting.org). Fixes: ace51c4d ("9p: add new protocol support code") Signed-off-by:Fedor Pchelkin <pchelkin@ispras.ru> Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru> Cc: stable@vger.kernel.org Reviewed-by:
Simon Horman <horms@kernel.org> Reviewed-by:
Christian Schoenebeck <linux_oss@crudebyte.com> Signed-off-by:
Dominique Martinet <asmadeus@codewreck.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
4e7f3899
Please register or sign in to comment