net: 9p: avoid freeing uninit memory in p9pdu_vreadf

If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails,
the error path is not handled properly. *wnames or members of *wnames
array may be left uninitialized and invalidly freed.

Initialize *wnames to NULL in beginning of case 'T'. Initialize the first
*wnames array element to NULL and nullify the failing *wnames element so
that the error path freeing loop stops on the first NULL element and
doesn't proceed further.

Found by Linux Verification Center (linuxtesting.org).

Fixes: ace51c4dd2f9 ("9p: add new protocol support code")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru>
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>

diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 4e3a2a1..0e6603b 100644 (file)
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -394,6 +394,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                uint16_t *nwname = va_arg(ap, uint16_t *);
                                char ***wnames = va_arg(ap, char ***);
 
+                               *wnames = NULL;
+
                                errcode = p9pdu_readf(pdu, proto_version,
                                                                "w", nwname);
                                if (!errcode) {
@@ -403,6 +405,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                          GFP_NOFS);
                                        if (!*wnames)
                                                errcode = -ENOMEM;
+                                       else
+                                               (*wnames)[0] = NULL;
                                }
 
                                if (!errcode) {
@@ -414,8 +418,10 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                                proto_version,
                                                                "s",
                                                                &(*wnames)[i]);
-                                               if (errcode)
+                                               if (errcode) {
+                                                       (*wnames)[i] = NULL;
                                                        break;
+                                               }
                                        }
                                }
 
@@ -423,11 +429,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                        if (*wnames) {
                                                int i;
 
-                                               for (i = 0; i < *nwname; i++)
+                                               for (i = 0; i < *nwname; i++) {
+                                                       if (!(*wnames)[i])
+                                                               break;
                                                        kfree((*wnames)[i]);
+                                               }
+                                               kfree(*wnames);
+                                               *wnames = NULL;
                                        }
-                                       kfree(*wnames);
-                                       *wnames = NULL;
                                }
                        }
                        break;