Commit 108a020c authored by Fedor Pchelkin's avatar Fedor Pchelkin Committed by Steve French
Browse files

ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails 



ksmbd_iov_pin_rsp_read() doesn't free the provided aux buffer if it
fails. Seems to be the caller's responsibility to clear the buffer in
error case.

Found by Linux Verification Center (linuxtesting.org).

Fixes: e2b76ab8 ("ksmbd: add support for read compound")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarFedor Pchelkin <pchelkin@ispras.ru>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent a12bc360

fs/smb/server/smb2pdu.c

+6 −2
Original line number Diff line number Diff line
@@ -6173,8 +6173,10 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work) 
		err = ksmbd_iov_pin_rsp_read(work, (void *)rsp,

					     offsetof(struct smb2_read_rsp, Buffer),

					     aux_payload_buf, nbytes);

		if (err)

		if (err) {

			kvfree(aux_payload_buf);

			goto out;

		}

		kvfree(rpc_resp);

	} else {

		err = ksmbd_iov_pin_rsp(work, (void *)rsp,
@@ -6384,8 +6386,10 @@ int smb2_read(struct ksmbd_work *work) 
	err = ksmbd_iov_pin_rsp_read(work, (void *)rsp,

				     offsetof(struct smb2_read_rsp, Buffer),

				     aux_payload_buf, nbytes);

	if (err)

	if (err) {

		kvfree(aux_payload_buf);

		goto out;

	}

	ksmbd_fd_put(work, fp);

	return 0;