lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 054/339] ksmbd: fix reference count leak in smb_check_perm_dacl()
    Date
    From: Xin Xiong <xiongx18@fudan.edu.cn>

    [ Upstream commit d21a580dafc69aa04f46e6099616146a536b0724 ]

    The issue happens in a specific path in smb_check_perm_dacl(). When
    "id" and "uid" have the same value, the function simply jumps out of
    the loop without decrementing the reference count of the object
    "posix_acls", which is increased by get_acl() earlier. This may
    result in memory leaks.

    Fix it by decreasing the reference count of "posix_acls" before
    jumping to label "check_access_bits".

    Fixes: 777cad1604d6 ("ksmbd: remove select FS_POSIX_ACL in Kconfig")
    Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ksmbd/smbacl.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c
    index 6ecf55ea1fed..38f23bf981ac 100644
    --- a/fs/ksmbd/smbacl.c
    +++ b/fs/ksmbd/smbacl.c
    @@ -1261,6 +1261,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path,
    if (!access_bits)
    access_bits =
    SET_MINIMUM_RIGHTS;
    + posix_acl_release(posix_acls);
    goto check_access_bits;
    }
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 15:36    [W:4.023 / U:0.864 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site