Messages in this thread | | | Date | Mon, 6 Feb 2023 10:33:00 +0800 | Subject | Re: [PATCH] ksmbd: fix possible memory leak in smb2_lock() | From | Hangyu Hua <> |
| |
On 4/2/2023 18:10, Namjae Jeon wrote: > 2023-02-01 17:10 GMT+09:00, Hangyu Hua <hbh25y@gmail.com>: >> argv needs to be free when setup_async_work fails or when the current >> process is woken up. >> >> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") >> Signed-off-by: Hangyu Hua <hbh25y@gmail.com> >> --- >> fs/ksmbd/smb2pdu.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c >> index d681f91947d9..5b7668c04f76 100644 >> --- a/fs/ksmbd/smb2pdu.c >> +++ b/fs/ksmbd/smb2pdu.c >> @@ -7050,6 +7050,7 @@ int smb2_lock(struct ksmbd_work *work) >> smb2_remove_blocked_lock, >> argv); >> if (rc) { >> + kfree(argv); >> err = -ENOMEM; >> goto out; >> } >> @@ -7061,6 +7062,8 @@ int smb2_lock(struct ksmbd_work *work) >> >> ksmbd_vfs_posix_lock_wait(flock); >> >> + work->cancel_fn = NULL; >> + kfree(argv); > This change seems to causes a NULL pointer dereference issue in > set_close_state_blocked_works(). It is right to free it and set NULL > after removing entry from list.
I get it. I will send a v2.
Thanks, Hangyu >> if (work->state != KSMBD_WORK_ACTIVE) { >> list_del(&smb_lock->llist); >> spin_lock(&work->conn->llist_lock); >> -- >> 2.34.1 >> >>
| |