* [PATCH] fs: tftp: Fix NULL pointer deref in file upload
@ 2023-03-15 9:53 Sascha Hauer
0 siblings, 0 replies; only message in thread
From: Sascha Hauer @ 2023-03-15 9:53 UTC (permalink / raw)
To: Barebox List
With TFTP upload the window cache is unused, but still freed in
tftp_do_close(). To avoid iterating on the uninitialized list,
initialize it unconditionally and not only for the download case.
Fixes: 3f1ea0ffcf8b ("tftp: implement UDP reorder cache using lists")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
fs/tftp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/tftp.c b/fs/tftp.c
index a63b133caa..c6edc9969f 100644
--- a/fs/tftp.c
+++ b/fs/tftp.c
@@ -384,10 +384,10 @@ static int tftp_allocate_transfer(struct file_priv *priv)
priv->fifo = NULL;
goto err;
}
- } else {
- INIT_LIST_HEAD(&priv->cache.blocks);
}
+ INIT_LIST_HEAD(&priv->cache.blocks);
+
return 0;
err:
--
2.30.2
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2023-03-15 9:54 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-15 9:53 [PATCH] fs: tftp: Fix NULL pointer deref in file upload Sascha Hauer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox