]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ksmbd: fail share config requests when path allocation fails
authorShuhao Fu <sfual@cse.ust.hk>
Wed, 29 Apr 2026 08:59:56 +0000 (16:59 +0800)
committerSteve French <stfrench@microsoft.com>
Sat, 2 May 2026 02:49:35 +0000 (21:49 -0500)
commita74668eb2c0b866d7ac4823be6006ab2e227bc03
tree651fc5f0ade7b4aac85a144b0d31b0f6e468d46a
parentbf736184d063da1a552ffeff0481813599a182cc
ksmbd: fail share config requests when path allocation fails

Non-pipe shares must have a duplicated backing path before they can be
published. share_config_request() currently calls kstrndup() for that
path, but if the allocation fails it leaves ret unchanged. If veto list
parsing succeeds and share->name exists, the partially built share is
still inserted into the global share table with share->path left NULL.

A later share-root SMB2 create uses tree_conn->share_conf->path as the
lookup root. If the share was published with path == NULL, that request
passes a NULL pathname into do_getname_kernel()/strlen() and can crash
the ksmbd worker.

Set ret = -ENOMEM when path duplication fails so the incomplete share is
destroyed before publication.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/mgmt/share_config.c