fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free

The 2nd buffer could be NULL even if iov_len is not zero. This can
trigger a panic when handling symlinks. It's easy to reproduce with
LTP fs_racer scripts[1] which are randomly craete/delete/link files
and dirs. Fix this panic by checking if the 2nd buffer is padding
before kfree, like what we do in SMB2_open_free.

[1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer

Fixes: 2c87d6a94d16 ("cifs: Allocate memory for all iovs in smb2_ioctl")
Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Ronnie sahlberg <lsahlber@redhat.com>

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5b8d1482ffbd4369490e4afcada6c1fd9b598c5f..29b699d532eff2ad9091a2c17c66d1a14e3eeb74 100644 (file)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2620,10 +2620,12 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
 void
 SMB2_ioctl_free(struct smb_rqst *rqst)
 {
+       int i;
        if (rqst && rqst->rq_iov) {
                cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
-               if (rqst->rq_iov[1].iov_len)
-                       kfree(rqst->rq_iov[1].iov_base);
+               for (i = 1; i < rqst->rq_nvec; i++)
+                       if (rqst->rq_iov[i].iov_base != smb2_padding)
+                               kfree(rqst->rq_iov[i].iov_base);
        }
 }