]> git.ipfire.org Git - thirdparty/linux.git/commit
smb: client: fix potential UAF and double free in smb2_open_file()
authorPaulo Alcantara <pc@manguebit.org>
Thu, 5 Feb 2026 16:19:52 +0000 (13:19 -0300)
committerSteve French <stfrench@microsoft.com>
Sun, 8 Feb 2026 23:07:42 +0000 (17:07 -0600)
commitebbbc4bfad4cb355d17c671223d0814ee3ef4eda
treecb9da8233c242380b0448218f5da8c9f3b777501
parent05f7e89ab9731565d8a62e3b5d1ec206485eeb0b
smb: client: fix potential UAF and double free in smb2_open_file()

Zero out @err_iov and @err_buftype before retrying SMB2_open() to
prevent an UAF bug if @data != NULL, otherwise a double free.

Fixes: e3a43633023e ("smb/client: fix memory leak in smb2_open_file()")
Reported-by: David Howells <dhowells@redhat.com>
Closes: https://lore.kernel.org/r/2892312.1770306653@warthog.procyon.org.uk
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/smb2file.c