[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] nbd: Initialize reply on failure
From: |
Eric Blake |
Subject: |
[Qemu-devel] [PATCH] nbd: Initialize reply on failure |
Date: |
Fri, 19 Jul 2019 10:03:13 -0500 |
We've had two separate reports of a caller running into use of
uninitialized data if s->quit is set (one detected by gcc -O3, another
by valgrind), due to checking 'nbd_reply_is_simple(reply) || s->quit'
in the wrong order. Rather than chasing down which callers need to
pre-initialize reply, it's easier to guarantee that reply will always
be set by nbd_co_receive_one_chunk() even on failure.
Reported-by: Thomas Huth <address@hidden>
Reported-by: Andrey Shinkevich <address@hidden>
Signed-off-by: Eric Blake <address@hidden>
---
Replaces: https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg04477.html
Replaces: https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg03712.html
block/nbd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/nbd.c b/block/nbd.c
index 8d565cc624ec..f751a8e633e5 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -640,6 +640,7 @@ static coroutine_fn int nbd_co_receive_one_chunk(
request_ret, qiov, payload, errp);
if (ret < 0) {
+ memset(reply, 0, sizeof *reply);
s->quit = true;
} else {
/* For assert at loop start in nbd_connection_entry */
--
2.20.1
- [Qemu-devel] [PATCH] nbd: Initialize reply on failure,
Eric Blake <=