From 1e7ec6cf067025552bb10def7c49f4527d2f035f Mon Sep 17 00:00:00 2001 From: Dima Stepanov Date: Wed, 13 Jun 2018 11:19:54 +0300 Subject: [PATCH] memfd: fix possible usage of the uninitialized file descriptor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The qemu_memfd_alloc_check() routine allocates the fd variable on stack. This variable is initialized inside the qemu_memfd_alloc() function. There are several cases when *fd will be left unintialized which can lead to the unexpected close() in the qemu_memfd_free() call. Set file descriptor to -1 before calling the qemu_memfd_alloc routine. Signed-off-by: Dima Stepanov Reviewed-by: Marc-André Lureau Reviewed-by: Thomas Huth Signed-off-by: Thomas Huth --- util/memfd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/util/memfd.c b/util/memfd.c index d248a53c3c..6287946b61 100644 --- a/util/memfd.c +++ b/util/memfd.c @@ -187,6 +187,7 @@ bool qemu_memfd_alloc_check(void) int fd; void *ptr; + fd = -1; ptr = qemu_memfd_alloc("test", 4096, 0, &fd, NULL); memfd_check = ptr ? MEMFD_OK : MEMFD_KO; qemu_memfd_free(ptr, 4096, fd);