smb: client: Fix next buffer leak in receive_encrypted_standard()

receive_encrypted_standard() allocates next_buffer before checking
whether the number of compound PDUs already reached MAX_COMPOUND. If
the limit check fails, the function returns immediately and the newly
allocated next_buffer is not assigned to server->smallbuf/server->bigbuf,
making it leaked.

Move the MAX_COMPOUND check before allocating next_buffer.

Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 2964f461fc847714571f6dac24616c0bc7f970ef..c862a98e52df6ed2437ad1e97e38584cb4adde16 100644 (file)
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5111,6 +5111,12 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
 one_more:
        shdr = (struct smb2_hdr *)buf;
        next_cmd = le32_to_cpu(shdr->NextCommand);
+
+       if (*num_mids >= MAX_COMPOUND) {
+               cifs_server_dbg(VFS, "too many PDUs in compound\n");
+               return -1;
+       }
+
        if (next_cmd) {
                if (WARN_ON_ONCE(next_cmd > pdu_length))
                        return -1;
@@ -5134,10 +5140,6 @@ one_more:
                mid_entry->resp_buf_size = server->pdu_size;
        }
 
-       if (*num_mids >= MAX_COMPOUND) {
-               cifs_server_dbg(VFS, "too many PDUs in compound\n");
-               return -1;
-       }
        bufs[*num_mids] = buf;
        mids[(*num_mids)++] = mid_entry;