The patch titled
Subject: net/9p/client.c: version pointer uninitialized
has been removed from the -mm tree. Its filename was
version-pointer-uninitialized.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Tomas Bortoli <tomasbortoli@xxxxxxxxx>
Subject: net/9p/client.c: version pointer uninitialized
The p9_client_version() does not initialize the version pointer. If the
call to p9pdu_readf() returns an error and version has not been allocated
in p9pdu_readf(), then the program will jump to the "error" label and will
try to free the version pointer. If version is not initialized, free()
will be called with uninitialized, garbage data and will provoke a crash.
Link: http://lkml.kernel.org/r/20180709222943.19503-1-tomasbortoli@xxxxxxxxx
Signed-off-by: Tomas Bortoli <tomasbortoli@xxxxxxxxx>
Reported-by: syzbot+65c6b72f284a39d416b4@xxxxxxxxxxxxxxxxxxxxxxxxx
Reviewed-by: Jun Piao <piaojun@xxxxxxxxxx>
Reviewed-by: Yiwen Jiang <jiangyiwen@xxxxxxxxxx>
Cc: Eric Van Hensbergen <ericvh@xxxxxxxxx>
Cc: Ron Minnich <rminnich@xxxxxxxxxx>
Cc: Latchesar Ionkov <lucho@xxxxxxxxxx>
Cc: Dominique Martinet <asmadeus@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
net/9p/client.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN net/9p/client.c~version-pointer-uninitialized net/9p/client.c
--- a/net/9p/client.c~version-pointer-uninitialized
+++ a/net/9p/client.c
@@ -958,7 +958,7 @@ static int p9_client_version(struct p9_c
{
int err = 0;
struct p9_req_t *req;
- char *version;
+ char *version = NULL;
int msize;
p9_debug(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n",
_
Patches currently in -mm which might be from tomasbortoli@xxxxxxxxx are
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
