Commit 27b7c3e9 authored by Stefan Metzmacher's avatar Stefan Metzmacher Committed by Steve French
Browse files

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() 



smbd_send_batch_flush() already calls smbd_free_send_io(),
so we should not call it again after smbd_post_send()
moved it to the batch list.

Reported-by: default avatarRuikai Peng <ruikai@pwno.io>
Closes: https://lore.kernel.org/linux-cifs/CAFD3drNOSJ05y3A+jNXSDxW-2w09KHQ0DivhxQ_pcc7immVVOQ@mail.gmail.com/


Fixes: 21538121 ("smb: client: make use of smbdirect_socket.send_io.bcredits")
Cc: stable@kernel.org
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Cc: Ruikai Peng <ruikai@pwno.io>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Cc: security@kernel.org
Acked-by: default avatarPaulo Alcantara (Red Hat) <pc@manguebit.org>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarStefan Metzmacher <metze@samba.org>
Tested-by: default avatarRuikai Peng <ruikai@pwno.io>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 3e298897

fs/smb/client/smbdirect.c

+8 −0
Original line number Diff line number Diff line
@@ -1551,17 +1551,25 @@ static int smbd_post_send_iter(struct smbdirect_socket *sc, 


	rc = smbd_post_send(sc, batch, request);

	if (!rc) {

		/*

		 * From here request is moved to batch

		 * and we should not free it explicitly.

		 */



		if (batch != &_batch)

			return 0;



		rc = smbd_send_batch_flush(sc, batch, true);

		if (!rc)

			return 0;



		goto err_flush;

	}



err_dma:

	smbd_free_send_io(request);



err_flush:

err_alloc:

	atomic_inc(&sc->send_io.credits.count);

	wake_up(&sc->send_io.credits.wait_queue);