]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: fix use-after-free in smb2_lock
authorNamjae Jeon <linkinjeon@kernel.org>
Wed, 26 Feb 2025 06:44:02 +0000 (15:44 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Mar 2025 12:01:51 +0000 (13:01 +0100)
commita0609097fd10d618aed4864038393dd75131289e
tree40f4052727868f02596c30fb2f9db9f2f721f940
parent159d059cbcb0e6d0e7a7b34af3862ba09a6b22d1
ksmbd: fix use-after-free in smb2_lock

commit 84d2d1641b71dec326e8736a749b7ee76a9599fc upstream.

If smb_lock->zero_len has value, ->llist of smb_lock is not delete and
flock is old one. It will cause use-after-free on error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/smb2pdu.c