Commit c15e7c62 authored by Guenter Roeck's avatar Guenter Roeck Committed by Steve French
Browse files

smb/server: Fix another refcount leak in smb2_open() 



If ksmbd_override_fsids() fails, we jump to err_out2. At that point, fp is
NULL because it hasn't been assigned dh_info.fp yet, so ksmbd_fd_put(work,
fp) will not be called. However, dh_info.fp was already inserted into the
session file table by ksmbd_reopen_durable_fd(), so it will leak in the
session file table until the session is closed.

Move fp = dh_info.fp; ahead of the ksmbd_override_fsids() check to fix the
problem.

Found by an experimental AI code review agent at Google.

Fixes: c8efcc78 ("ksmbd: add support for durable handles v1/v2")
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Reviewed-by: default avatarChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 1f318b96

fs/smb/server/smb2pdu.c

+2 −1
Original line number Diff line number Diff line
@@ -3012,13 +3012,14 @@ int smb2_open(struct ksmbd_work *work) 
				goto err_out2;

			}



			fp = dh_info.fp;



			if (ksmbd_override_fsids(work)) {

				rc = -ENOMEM;

				ksmbd_put_durable_fd(dh_info.fp);

				goto err_out2;

			}



			fp = dh_info.fp;

			file_info = FILE_OPENED;



			rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat);