[Qemu-devel] [PATCH] nbd: Initialize reply on failure

[Eric Blake <eblake@redhat.com>]

We've had two separate reports of a caller running into use of
uninitialized data if s->quit is set (one detected by gcc -O3, another
by valgrind), due to checking 'nbd_reply_is_simple(reply) || s->quit'
in the wrong order. Rather than chasing down which callers need to
pre-initialize reply, it's easier to guarantee that reply will always
be set by nbd_co_receive_one_chunk() even on failure.

Reported-by: Thomas Huth <thuth@redhat.com>
Reported-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---

Replaces: https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg04477.html
Replaces: https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg03712.html

 block/nbd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/nbd.c b/block/nbd.c
index 8d565cc624ec..f751a8e633e5 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -640,6 +640,7 @@ static coroutine_fn int nbd_co_receive_one_chunk(
                                           request_ret, qiov, payload, errp);

     if (ret < 0) {
+        memset(reply, 0, sizeof *reply);
         s->quit = true;
     } else {
         /* For assert at loop start in nbd_connection_entry */
-- 
2.20.1