Skip to content
Commit 6457c20e authored by Murphy Zhou's avatar Murphy Zhou Committed by Steve French
Browse files

fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free

The 2nd buffer could be NULL even if iov_len is not zero. This can
trigger a panic when handling symlinks. It's easy to reproduce with
LTP fs_racer scripts[1] which are randomly craete/delete/link files
and dirs. Fix this panic by checking if the 2nd buffer is padding
before kfree, like what we do in SMB2_open_free.

[1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer

Fixes: 2c87d6a9

 ("cifs: Allocate memory for all iovs in smb2_ioctl")
Signed-off-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Reviewed-by: default avatarRonnie sahlberg <lsahlber@redhat.com>
parent 21078203
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment