]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
smb: client: Reset all search buffer pointers when releasing buffer
authorWang Zhaolong <wangzhaolong1@huawei.com>
Fri, 16 May 2025 09:12:56 +0000 (17:12 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Jun 2025 12:38:07 +0000 (14:38 +0200)
commit9fdb86f0bf65a7725c4e90ea18acd9e0e2e92820
treee53f8fc3dda21ce5026091ce278b8412735b2339
parent1b197931fbc821bc7e9e91bf619400db563e3338
smb: client: Reset all search buffer pointers when releasing buffer

commit e48f9d849bfdec276eebf782a84fd4dfbe1c14c0 upstream.

Multiple pointers in struct cifs_search_info (ntwrk_buf_start,
srch_entries_start, and last_entry) point to the same allocated buffer.
However, when freeing this buffer, only ntwrk_buf_start was set to NULL,
while the other pointers remained pointing to freed memory.

This is defensive programming to prevent potential issues with stale
pointers. While the active UAF vulnerability is fixed by the previous
patch, this change ensures consistent pointer state and more robust error
handling.

Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com>
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/cifs/readdir.c