Commit 8cf9bedf authored by Fedor Pchelkin's avatar Fedor Pchelkin Committed by Steve French
Browse files

ksmbd: free ppace array on error in parse_dacl 



The ppace array is not freed if one of the init_acl_state() calls inside
parse_dacl() fails. At the moment the function may fail only due to the
memory allocation errors so it's highly unlikely in this case but
nevertheless a fix is needed.

Move ppace allocation after the init_acl_state() calls with proper error
handling.

Found by Linux Verification Center (linuxtesting.org).

Fixes: e2f34481 ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarFedor Pchelkin <pchelkin@ispras.ru>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 3fc74c65

fs/smb/server/smbacl.c

+7 −4
Original line number Diff line number Diff line
@@ -401,10 +401,6 @@ static void parse_dacl(struct mnt_idmap *idmap, 
	if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))

		return;



	ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL);

	if (!ppace)

		return;



	ret = init_acl_state(&acl_state, num_aces);

	if (ret)

		return;
@@ -414,6 +410,13 @@ static void parse_dacl(struct mnt_idmap *idmap, 
		return;

	}



	ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL);

	if (!ppace) {

		free_acl_state(&default_acl_state);

		free_acl_state(&acl_state);

		return;

	}



	/*

	 * reset rwx permissions for user/group/other.

	 * Also, if num_aces is 0 i.e. DACL has no ACEs,