Commit ce070879 authored by Hangyu Hua's avatar Hangyu Hua Committed by Dominique Martinet
Browse files

9p/net: fix possible memory leak in p9_check_errors() 



When p9pdu_readf() is called with "s?d" attribute, it allocates a pointer
that will store a string. But when p9pdu_readf() fails while handling "d"
then this pointer will not be freed in p9_check_errors().

Fixes: 51a87c55 ("9p: rework client code to use new protocol support functions")
Reviewed-by: default avatarChristian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Message-ID: <20231027030302.11927-1-hbh25y@gmail.com>
Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
parent e02be639

net/9p/client.c

+4 −2
Original line number Diff line number Diff line
@@ -540,12 +540,14 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req) 
		return 0;



	if (!p9_is_proto_dotl(c)) {

		char *ename;

		char *ename = NULL;



		err = p9pdu_readf(&req->rc, c->proto_version, "s?d",

				  &ename, &ecode);

		if (err)

		if (err) {

			kfree(ename);

			goto out_err;

		}



		if (p9_is_proto_dotu(c) && ecode < 512)

			err = -ecode;