From: Fedor Pchelkin Date: Mon, 5 Feb 2024 11:19:16 +0000 (+0300) Subject: ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails X-Git-Tag: v5.15.150~173 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=43ea43b6fa17a7b8e6cac0b1f0f52e7d3ee99d41;p=thirdparty%2Fkernel%2Fstable.git ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails [ Upstream commit 108a020c64434fed4b69762879d78cd24088b4c7 ] ksmbd_iov_pin_rsp_read() doesn't free the provided aux buffer if it fails. Seems to be the caller's responsibility to clear the buffer in error case. Found by Linux Verification Center (linuxtesting.org). Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Acked-by: Namjae Jeon Signed-off-by: Steve French Signed-off-by: Sasha Levin --- diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 7e8f1c89124fa..0613b8d14409c 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6175,8 +6175,10 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work) err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, offsetof(struct smb2_read_rsp, Buffer), aux_payload_buf, nbytes); - if (err) + if (err) { + kvfree(aux_payload_buf); goto out; + } kvfree(rpc_resp); } else { err = ksmbd_iov_pin_rsp(work, (void *)rsp, @@ -6386,8 +6388,10 @@ int smb2_read(struct ksmbd_work *work) err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, offsetof(struct smb2_read_rsp, Buffer), aux_payload_buf, nbytes); - if (err) + if (err) { + kvfree(aux_payload_buf); goto out; + } ksmbd_fd_put(work, fp); return 0;