ksmbd: fix memory leak of xattr_stream_name in smb2_rename()

On an SMB2 SET_INFO(FileRenameInformation) whose target names an alternate
data stream, smb2_rename() obtains a formatted stream-name string from
ksmbd_vfs_xattr_stream_name(), which allocates it with kasprintf() and
returns it through an out-param:

	rc = ksmbd_vfs_xattr_stream_name(stream_name, &xattr_stream_name, ...);
	if (rc)
		goto out;
	rc = ksmbd_vfs_setxattr(..., xattr_stream_name, ...);
	if (rc < 0) {
		...
		goto out;
	}
	goto out;

xattr_stream_name is declared inside the alternate-data-stream block, but
the out: label is outside that block and frees only new_name, so it cannot
release xattr_stream_name. ksmbd_vfs_setxattr() takes a const char * and
only reads the name, so it does not take ownership either. Both the
setxattr-failure and the success path therefore leak the kasprintf()'d
string. An authenticated client with a writable share can leak kernel
memory on every stream rename, exhausting kernel memory over time.

Free xattr_stream_name after its use, before the block's goto out. The
two earlier goto out paths never assign the variable, so there is no
double-free.

Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index c407425cbba016614b6c58866e1a225bc16cb637..c8acf9f04e45405c3a4c5f038c433f83ff102593 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6597,9 +6597,8 @@ static int smb2_rename(struct ksmbd_work *work,
                        pr_err("failed to store stream name in xattr: %d\n",
                               rc);
                        rc = -EINVAL;
-                       goto out;
                }
-
+               kfree(xattr_stream_name);
                goto out;
        }