summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorMurphy Zhou <jencce.kernel@gmail.com>2019-05-23 07:12:43 +0300
committerSteve French <stfrench@microsoft.com>2019-05-29 03:11:35 +0300
commit6457c20e336867fc90286d35bddcc9c0b0aaa936 (patch)
tree9e545a3cd099b42f42683652c59dd11e5487b8b0 /fs
parent210782038b54ec8e9059a3c12d6f6ae173efa3a9 (diff)
downloadlinux-6457c20e336867fc90286d35bddcc9c0b0aaa936.tar.xz
fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free
The 2nd buffer could be NULL even if iov_len is not zero. This can trigger a panic when handling symlinks. It's easy to reproduce with LTP fs_racer scripts[1] which are randomly craete/delete/link files and dirs. Fix this panic by checking if the 2nd buffer is padding before kfree, like what we do in SMB2_open_free. [1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer Fixes: 2c87d6a94d16 ("cifs: Allocate memory for all iovs in smb2_ioctl") Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Reviewed-by: Ronnie sahlberg <lsahlber@redhat.com>
Diffstat (limited to 'fs')
-rw-r--r--fs/cifs/smb2pdu.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5b8d1482ffbd..29b699d532ef 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2620,10 +2620,12 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
void
SMB2_ioctl_free(struct smb_rqst *rqst)
{
+ int i;
if (rqst && rqst->rq_iov) {
cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
- if (rqst->rq_iov[1].iov_len)
- kfree(rqst->rq_iov[1].iov_base);
+ for (i = 1; i < rqst->rq_nvec; i++)
+ if (rqst->rq_iov[i].iov_base != smb2_padding)
+ kfree(rqst->rq_iov[i].iov_base);
}
}