linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Dominique Martinet <dominique.martinet@cea.fr>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.9 21/21] 9p: clear dangling pointers in p9stat_free
Date: Sun,  4 Nov 2018 08:53:55 -0500	[thread overview]
Message-ID: <20181104135355.88602-21-sashal@kernel.org> (raw)
In-Reply-To: <20181104135355.88602-1-sashal@kernel.org>

From: Dominique Martinet <dominique.martinet@cea.fr>

[ Upstream commit 62e3941776fea8678bb8120607039410b1b61a65 ]

p9stat_free is more of a cleanup function than a 'free' function as it
only frees the content of the struct; there are chances of use-after-free
if it is improperly used (e.g. p9stat_free called twice as it used to be
possible to)

Clearing dangling pointers makes the function idempotent and safer to use.

Link: http://lkml.kernel.org/r/1535410108-20650-2-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Reported-by: syzbot+d4252148d198410b864f@syzkaller.appspotmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/9p/protocol.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 16d287565987..145f80518064 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...);
 void p9stat_free(struct p9_wstat *stbuf)
 {
 	kfree(stbuf->name);
+	stbuf->name = NULL;
 	kfree(stbuf->uid);
+	stbuf->uid = NULL;
 	kfree(stbuf->gid);
+	stbuf->gid = NULL;
 	kfree(stbuf->muid);
+	stbuf->muid = NULL;
 	kfree(stbuf->extension);
+	stbuf->extension = NULL;
 }
 EXPORT_SYMBOL(p9stat_free);
 
-- 
2.17.1


      parent reply	other threads:[~2018-11-04 13:54 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-04 13:53 [PATCH AUTOSEL 4.9 01/21] mm/vmstat.c: assert that vmstat_text is in sync with stat_items_size Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 02/21] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 03/21] mm: don't warn about large allocations for slab Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 04/21] powerpc/eeh: Fix possible null deref in eeh_dump_dev_log() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 05/21] tty: check name length in tty_find_polling_driver() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 06/21] ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 07/21] powerpc/nohash: fix undefined behaviour when testing page size support Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 08/21] watchdog: lantiq: update register names to better match spec Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 09/21] drm/omap: fix memory barrier bug in DMM driver Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 10/21] iio: adc: at91: fix wrong channel number in triggered buffer mode Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 11/21] iio: adc: at91: fix acking DRDY irq on simple conversions Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 12/21] media: pci: cx23885: handle adding to list failure Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 13/21] iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 14/21] MIPS: kexec: Mark CPU offline before disabling local IRQ Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 15/21] powerpc/boot: Ensure _zimage_start is a weak symbol Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 16/21] MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 17/21] sc16is7xx: Fix for multi-channel stall Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 18/21] media: tvp5150: fix width alignment during set_selection() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 19/21] powerpc/selftests: Wait all threads to join Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 20/21] 9p locks: fix glock.client_id leak in do_lock Sasha Levin
2018-11-04 13:53 ` Sasha Levin [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181104135355.88602-21-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=dominique.martinet@cea.fr \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).