Commit 28b7bd4a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag '6.1-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 

Pull cifs fixes from Steve French:

 - use after free fix for reconnect race

 - two memory leak fixes

* tag '6.1-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: fix use-after-free caused by invalid pointer `hostname`
  cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
  cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc()
parents 882ad2a2 153695d3

fs/cifs/connect.c

+1 −0
Original line number Diff line number Diff line
@@ -1584,6 +1584,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) 
	server->session_key.response = NULL;

	server->session_key.len = 0;

	kfree(server->hostname);

	server->hostname = NULL;



	task = xchg(&server->tsk, NULL);

	if (task)

fs/cifs/file.c

+10 −3
Original line number Diff line number Diff line
@@ -2434,12 +2434,16 @@ cifs_writev_complete(struct work_struct *work) 
struct cifs_writedata *

cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete)

{

	struct cifs_writedata *writedata = NULL;

	struct page **pages =

		kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);

	if (pages)

		return cifs_writedata_direct_alloc(pages, complete);

	if (pages) {

		writedata = cifs_writedata_direct_alloc(pages, complete);

		if (!writedata)

			kvfree(pages);

	}



	return NULL;

	return writedata;

}



struct cifs_writedata *
@@ -3299,6 +3303,9 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from, 
					     cifs_uncached_writev_complete);

			if (!wdata) {

				rc = -ENOMEM;

				for (i = 0; i < nr_pages; i++)

					put_page(pagevec[i]);

				kvfree(pagevec);

				add_credits_and_wake_if(server, credits, 0);

				break;

			}