diff options
| author | Dima Stepanov <dimastep@yandex-team.ru> | 2018-06-13 11:19:54 +0300 |
|---|---|---|
| committer | Thomas Huth <thuth@redhat.com> | 2018-09-25 17:26:18 +0200 |
| commit | 1e7ec6cf067025552bb10def7c49f4527d2f035f (patch) | |
| tree | 2d70a6908abe8cf382eebdd98f78d2dd7ceedc9f | |
| parent | 91c082ad86e96ee342faaa024d46fd3e6242a98e (diff) | |
memfd: fix possible usage of the uninitialized file descriptor
The qemu_memfd_alloc_check() routine allocates the fd variable on stack.
This variable is initialized inside the qemu_memfd_alloc() function.
There are several cases when *fd will be left unintialized which can
lead to the unexpected close() in the qemu_memfd_free() call.
Set file descriptor to -1 before calling the qemu_memfd_alloc routine.
Signed-off-by: Dima Stepanov <dimastep@yandex-team.ru>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
| -rw-r--r-- | util/memfd.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/util/memfd.c b/util/memfd.c index d248a53c3c..6287946b61 100644 --- a/util/memfd.c +++ b/util/memfd.c @@ -187,6 +187,7 @@ bool qemu_memfd_alloc_check(void) int fd; void *ptr; + fd = -1; ptr = qemu_memfd_alloc("test", 4096, 0, &fd, NULL); memfd_check = ptr ? MEMFD_OK : MEMFD_KO; qemu_memfd_free(ptr, 4096, fd); |