net: 9p: avoid freeing uninit memory in p9pdu_vreadf

[linux-2.6-microblaze.git] / net / 9p / protocol.c

diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 4e3a2a1..0e6603b 100644 (file)
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -394,6 +394,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                uint16_t *nwname = va_arg(ap, uint16_t *);
                                char ***wnames = va_arg(ap, char ***);
 
+                               *wnames = NULL;
+
                                errcode = p9pdu_readf(pdu, proto_version,
                                                                "w", nwname);
                                if (!errcode) {
@@ -403,6 +405,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                          GFP_NOFS);
                                        if (!*wnames)
                                                errcode = -ENOMEM;
+                                       else
+                                               (*wnames)[0] = NULL;
                                }
 
                                if (!errcode) {
@@ -414,8 +418,10 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                                proto_version,
                                                                "s",
                                                                &(*wnames)[i]);
-                                               if (errcode)
+                                               if (errcode) {
+                                                       (*wnames)[i] = NULL;
                                                        break;
+                                               }
                                        }
                                }
 
@@ -423,11 +429,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                        if (*wnames) {
                                                int i;
 
-                                               for (i = 0; i < *nwname; i++)
+                                               for (i = 0; i < *nwname; i++) {
+                                                       if (!(*wnames)[i])
+                                                               break;
                                                        kfree((*wnames)[i]);
+                                               }
+                                               kfree(*wnames);
+                                               *wnames = NULL;
                                        }
-                                       kfree(*wnames);
-                                       *wnames = NULL;
                                }
                        }
                        break;