diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2023-10-11 16:30:26 +0200 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-10-13 05:44:11 +0200 |
| commit | 1903e6d0578118e9aab1ee23f4a9de55737d1d05 (patch) | |
| tree | 959c878e436317658322f4aaa4b7296b770840c1 /fs/smb/server/smb2pdu.c | |
| parent | ksmbd: fix Null pointer dereferences in ksmbd_update_fstate() (diff) | |
| download | linux-1903e6d0578118e9aab1ee23f4a9de55737d1d05.tar.xz linux-1903e6d0578118e9aab1ee23f4a9de55737d1d05.zip | |
ksmbd: fix potential double free on smb2_read_pipe() error path
Fix new smatch warnings:
fs/smb/server/smb2pdu.c:6131 smb2_read_pipe() error: double free of 'rpc_resp'
Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to '')
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 87c6401a6007..93262ca3f58a 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -6152,12 +6152,12 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work) memcpy(aux_payload_buf, rpc_resp->payload, rpc_resp->payload_sz); nbytes = rpc_resp->payload_sz; - kvfree(rpc_resp); err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, offsetof(struct smb2_read_rsp, Buffer), aux_payload_buf, nbytes); if (err) goto out; + kvfree(rpc_resp); } else { err = ksmbd_iov_pin_rsp(work, (void *)rsp, offsetof(struct smb2_read_rsp, Buffer)); |