From: Dima Stepanov <dimastep@yandex-team.ru>
Date: Wed, 13 Jun 2018 08:19:54 +0000 (+0300)
Subject: memfd: fix possible usage of the uninitialized file descriptor
X-Git-Tag: qemu-xen-4.13.0-rc1~654^2~8
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=1e7ec6cf067025552bb10def7c49f4527d2f035f;p=qemu-xen.git

memfd: fix possible usage of the uninitialized file descriptor

The qemu_memfd_alloc_check() routine allocates the fd variable on stack.
This variable is initialized inside the qemu_memfd_alloc() function.
There are several cases when *fd will be left unintialized which can
lead to the unexpected close() in the qemu_memfd_free() call.

Set file descriptor to -1 before calling the qemu_memfd_alloc routine.

Signed-off-by: Dima Stepanov <dimastep@yandex-team.ru>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---

diff --git a/util/memfd.c b/util/memfd.c
index d248a53c3c..6287946b61 100644
--- a/util/memfd.c
+++ b/util/memfd.c
@@ -187,6 +187,7 @@ bool qemu_memfd_alloc_check(void)
         int fd;
         void *ptr;
 
+        fd = -1;
         ptr = qemu_memfd_alloc("test", 4096, 0, &fd, NULL);
         memfd_check = ptr ? MEMFD_OK : MEMFD_KO;
         qemu_memfd_free(ptr, 4096, fd);