Commit 658609d9 authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() 



opinfo_put() could be called twice on error of smb21_lease_break_ack().
It will cause UAF issue if opinfo is referenced on other places.

Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent c2a721ee

fs/smb/server/smb2pdu.c

+5 −5
Original line number Diff line number Diff line
@@ -8219,6 +8219,11 @@ static void smb21_lease_break_ack(struct ksmbd_work *work) 
			    le32_to_cpu(req->LeaseState));

	}



	if (ret < 0) {

		rsp->hdr.Status = err;

		goto err_out;

	}



	lease_state = lease->state;

	opinfo->op_state = OPLOCK_STATE_NONE;

	wake_up_interruptible_all(&opinfo->oplock_q);
@@ -8226,11 +8231,6 @@ static void smb21_lease_break_ack(struct ksmbd_work *work) 
	wake_up_interruptible_all(&opinfo->oplock_brk);

	opinfo_put(opinfo);



	if (ret < 0) {

		rsp->hdr.Status = err;

		goto err_out;

	}



	rsp->StructureSize = cpu_to_le16(36);

	rsp->Reserved = 0;

	rsp->Flags = 0;