Commit 1fe4a44b authored by Jethro Donaldson's avatar Jethro Donaldson Committed by Steve French
Browse files

smb: client: fix memory leak during error handling for POSIX mkdir 



The response buffer for the CREATE request handled by smb311_posix_mkdir()
is leaked on the error path (goto err_free_rsp_buf) because the structure
pointer *rsp passed to free_rsp_buf() is not assigned until *after* the
error condition is checked.

As *rsp is initialised to NULL, free_rsp_buf() becomes a no-op and the leak
is instead reported by __kmem_cache_shutdown() upon subsequent rmmod of
cifs.ko if (and only if) the error path has been hit.

Pass rsp_iov.iov_base to free_rsp_buf() instead, similar to the code in
other functions in smb2pdu.c for which *rsp is assigned late.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJethro Donaldson <devel@jro.nz>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 82f2b0b9

fs/smb/client/smb2pdu.c

+1 −1
Original line number Diff line number Diff line
@@ -2968,7 +2968,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 
	/* Eventually save off posix specific response info and timestamps */



err_free_rsp_buf:

	free_rsp_buf(resp_buftype, rsp);

	free_rsp_buf(resp_buftype, rsp_iov.iov_base);

	kfree(pc_buf);

err_free_req:

	cifs_small_buf_release(req);