diff options
| author | Murphy Zhou <[email protected]> | 2019-05-23 04:12:43 +0000 |
|---|---|---|
| committer | Steve French <[email protected]> | 2019-05-29 00:11:35 +0000 |
| commit | 6457c20e336867fc90286d35bddcc9c0b0aaa936 (patch) | |
| tree | 9e545a3cd099b42f42683652c59dd11e5487b8b0 /fs/proc/array.c | |
| parent | cifs: fix memory leak of pneg_inbuf on -EOPNOTSUPP ioctl case (diff) | |
| download | kernel-6457c20e336867fc90286d35bddcc9c0b0aaa936.tar.gz kernel-6457c20e336867fc90286d35bddcc9c0b0aaa936.zip | |
fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free
The 2nd buffer could be NULL even if iov_len is not zero. This can
trigger a panic when handling symlinks. It's easy to reproduce with
LTP fs_racer scripts[1] which are randomly craete/delete/link files
and dirs. Fix this panic by checking if the 2nd buffer is padding
before kfree, like what we do in SMB2_open_free.
[1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer
Fixes: 2c87d6a94d16 ("cifs: Allocate memory for all iovs in smb2_ioctl")
Signed-off-by: Murphy Zhou <[email protected]>
Signed-off-by: Steve French <[email protected]>
Reviewed-by: Ronnie sahlberg <[email protected]>
Diffstat (limited to 'fs/proc/array.c')
0 files changed, 0 insertions, 0 deletions