ksmbd: Fix resource leak in smb2_lock()

[ Upstream commit 01f6c61bae3d658058ee6322af77acea26a5ee3a ]

"flock" is leaked if an error happens before smb2_lock_init(), as the
lock is not added to the lock_list to be cleaned up.

Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 1e06049ee9878fb026ebd03cfb6e65502a0513f1..41dd887298a9e1e5bf9b027c0a71ba87c973f6cb 100644 (file)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -6907,6 +6907,7 @@ int smb2_lock(struct ksmbd_work *work)
                if (lock_start > U64_MAX - lock_length) {
                        pr_err("Invalid lock range requested\n");
                        rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE;
+                       locks_free_lock(flock);
                        goto out;
                }
 
@@ -6926,6 +6927,7 @@ int smb2_lock(struct ksmbd_work *work)
                                    "the end offset(%llx) is smaller than the start offset(%llx)\n",
                                    flock->fl_end, flock->fl_start);
                        rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE;
+                       locks_free_lock(flock);
                        goto out;
                }
 
@@ -6937,6 +6939,7 @@ int smb2_lock(struct ksmbd_work *work)
                                    flock->fl_type != F_UNLCK) {
                                        pr_err("conflict two locks in one request\n");
                                        err = -EINVAL;
+                                       locks_free_lock(flock);
                                        goto out;
                                }
                        }
@@ -6945,6 +6948,7 @@ int smb2_lock(struct ksmbd_work *work)
                smb_lock = smb2_lock_init(flock, cmd, flags, &lock_list);
                if (!smb_lock) {
                        err = -EINVAL;
+                       locks_free_lock(flock);
                        goto out;
                }
        }