From: Murphy Zhou Date: Thu, 23 May 2019 04:12:43 +0000 (+0800) Subject: fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=6457c20e336867fc90286d35bddcc9c0b0aaa936;p=openwrt%2Fstaging%2Fblogic.git fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free The 2nd buffer could be NULL even if iov_len is not zero. This can trigger a panic when handling symlinks. It's easy to reproduce with LTP fs_racer scripts[1] which are randomly craete/delete/link files and dirs. Fix this panic by checking if the 2nd buffer is padding before kfree, like what we do in SMB2_open_free. [1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer Fixes: 2c87d6a94d16 ("cifs: Allocate memory for all iovs in smb2_ioctl") Signed-off-by: Murphy Zhou Signed-off-by: Steve French Reviewed-by: Ronnie sahlberg --- diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 5b8d1482ffbd..29b699d532ef 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2620,10 +2620,12 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, void SMB2_ioctl_free(struct smb_rqst *rqst) { + int i; if (rqst && rqst->rq_iov) { cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ - if (rqst->rq_iov[1].iov_len) - kfree(rqst->rq_iov[1].iov_base); + for (i = 1; i < rqst->rq_nvec; i++) + if (rqst->rq_iov[i].iov_base != smb2_padding) + kfree(rqst->rq_iov[i].iov_base); } }