From patchwork Thu Sep 15 23:05:11 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg Kurz X-Patchwork-Id: 9334881 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id DFE39601C2 for ; Thu, 15 Sep 2016 23:05:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B8E6229BB9 for ; Thu, 15 Sep 2016 23:05:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A897F29C6E; Thu, 15 Sep 2016 23:05:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id DBA7829BB9 for ; Thu, 15 Sep 2016 23:05:45 +0000 (UTC) Received: from localhost ([::1]:37849 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bkfiy-0000g4-9f for patchwork-qemu-devel@patchwork.kernel.org; Thu, 15 Sep 2016 19:05:44 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48454) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bkfif-0000ft-4F for qemu-devel@nongnu.org; Thu, 15 Sep 2016 19:05:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bkfia-0004ke-0E for qemu-devel@nongnu.org; Thu, 15 Sep 2016 19:05:25 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:43431) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bkfiZ-0004k6-Ol for qemu-devel@nongnu.org; Thu, 15 Sep 2016 19:05:19 -0400 Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u8FN2iUa041439 for ; Thu, 15 Sep 2016 19:05:18 -0400 Received: from e34.co.us.ibm.com (e34.co.us.ibm.com [32.97.110.152]) by mx0a-001b2d01.pphosted.com with ESMTP id 25fr7ynajx-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 15 Sep 2016 19:05:18 -0400 Received: from localhost by e34.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 15 Sep 2016 17:05:17 -0600 Received: from d03dlp03.boulder.ibm.com (9.17.202.179) by e34.co.us.ibm.com (192.168.1.134) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 15 Sep 2016 17:05:14 -0600 Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by d03dlp03.boulder.ibm.com (Postfix) with ESMTP id 712C319D8026; Thu, 15 Sep 2016 17:04:43 -0600 (MDT) Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u8FN5Dbw4981070; Thu, 15 Sep 2016 16:05:13 -0700 Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC40A7803F; Thu, 15 Sep 2016 17:05:13 -0600 (MDT) Received: from [192.168.66.108] (unknown [9.164.164.67]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP id 5360278041; Thu, 15 Sep 2016 17:05:12 -0600 (MDT) From: Greg Kurz To: qemu-devel@nongnu.org Date: Fri, 16 Sep 2016 01:05:11 +0200 User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16091523-0016-0000-0000-000004B4F851 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00005767; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000185; SDB=6.00758105; UDB=6.00359738; IPR=6.00531746; BA=6.00004731; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00012685; XFM=3.00000011; UTC=2016-09-15 23:05:15 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16091523-0017-0000-0000-000032FE22ED Message-Id: <147398054143.25432.18026157491978434193.stgit@bahia> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-09-15_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=3 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1609020000 definitions=main-1609150307 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PATCH] 9pfs: fix potential segfault during walk X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , qemu-stable@nongnu.org, Greg Kurz , "Aneesh Kumar K.V" , Michael Roth Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP If the call to fid_to_qid() returns an error, we will call v9fs_path_free() on uninitialized paths. Let's fix this by initializing dpath and path before calling fid_to_qid(). Signed-off-by: Greg Kurz Reviewed-by: Cédric Le Goater --- Thanks Paolo (and Coverity) for spotting this. Cc'ing stable as this is a regression introduced in 2.7. It is also present in Michael's stable-2.6-staging branch. hw/9pfs/9p.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index dfe293d11d1c..91a497079acb 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -1320,13 +1320,14 @@ static void v9fs_walk(void *opaque) goto out_nofid; } + v9fs_path_init(&dpath); + v9fs_path_init(&path); + err = fid_to_qid(pdu, fidp, &qid); if (err < 0) { goto out; } - v9fs_path_init(&dpath); - v9fs_path_init(&path); /* * Both dpath and path initially poin to fidp. * Needed to handle request with nwnames == 0