The patch titled
Subject: net/9p/client.c: version pointer uninitialized
has been added to the -mm tree. Its filename is
version-pointer-uninitialized.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/version-pointer-uninitialized.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/version-pointer-uninitialized.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Tomas Bortoli <tomasbortoli@xxxxxxxxx>
Subject: net/9p/client.c: version pointer uninitialized
The p9_client_version() does not initialize the version pointer. If the
call to p9pdu_readf() returns an error and version has not been allocated
in p9pdu_readf(), then the program will jump to the "error" label and will
try to free the version pointer. If version is not initialized, free()
will be called with uninitialized, garbage data and will provoke a crash.
Link: http://lkml.kernel.org/r/20180709222943.19503-1-tomasbortoli@xxxxxxxxx
Signed-off-by: Tomas Bortoli <tomasbortoli@xxxxxxxxx>
Reported-by: syzbot+65c6b72f284a39d416b4@xxxxxxxxxxxxxxxxxxxxxxxxx
Reviewed-by: Jun Piao <piaojun@xxxxxxxxxx>
Cc: Eric Van Hensbergen <ericvh@xxxxxxxxx>
Cc: Ron Minnich <rminnich@xxxxxxxxxx>
Cc: Latchesar Ionkov <lucho@xxxxxxxxxx>
Cc: Dominique Martinet <asmadeus@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
net/9p/client.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN net/9p/client.c~version-pointer-uninitialized net/9p/client.c
--- a/net/9p/client.c~version-pointer-uninitialized
+++ a/net/9p/client.c
@@ -958,7 +958,7 @@ static int p9_client_version(struct p9_c
{
int err = 0;
struct p9_req_t *req;
- char *version;
+ char *version = NULL;
int msize;
p9_debug(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n",
_
Patches currently in -mm which might be from tomasbortoli@xxxxxxxxx are
autofs-fix-slab-out-of-bounds-read-in-getname_kernel.patch
version-pointer-uninitialized.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
