Commit eb4447bc authored by Wang Zhaolong's avatar Wang Zhaolong Committed by Steve French
Browse files

ksmbd: fix memory leak in parse_lease_state() 



The previous patch that added bounds check for create lease context
introduced a memory leak. When the bounds check fails, the function
returns NULL without freeing the previously allocated lease_ctx_info
structure.

This patch fixes the issue by adding kfree(lreq) before returning NULL
in both boundary check cases.

Fixes: bab703ed ("ksmbd: add bounds check for create lease context")
Signed-off-by: default avatarWang Zhaolong <wangzhaolong1@huawei.com>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 53e3e5ba

fs/smb/server/oplock.c

+5 −2
Original line number Diff line number Diff line
@@ -1496,7 +1496,7 @@ struct lease_ctx_info *parse_lease_state(void *open_req) 


		if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) <

		    sizeof(struct create_lease_v2) - 4)

			return NULL;

			goto err_out;



		memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE);

		lreq->req_state = lc->lcontext.LeaseState;
@@ -1512,7 +1512,7 @@ struct lease_ctx_info *parse_lease_state(void *open_req) 


		if (le16_to_cpu(cc->DataOffset) + le32_to_cpu(cc->DataLength) <

		    sizeof(struct create_lease))

			return NULL;

			goto err_out;



		memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE);

		lreq->req_state = lc->lcontext.LeaseState;
@@ -1521,6 +1521,9 @@ struct lease_ctx_info *parse_lease_state(void *open_req) 
		lreq->version = 1;

	}

	return lreq;

err_out:

	kfree(lreq);

	return NULL;

}



/**