Commit cb891e7a authored by Colin Ian King's avatar Colin Ian King Committed by Steve French

cifs: fix memory leak of an allocated cifs_ntsd structure

The call to SMB2_queary_acl can allocate memory to pntsd and also
return a failure via a call to SMB2_query_acl (and then query_info).
This occurs when query_info allocates the structure and then in
query_info the call to smb2_validate_and_copy_iov fails. Currently the
failure just returns without kfree'ing pntsd hence causing a memory
leak.

Currently, *data is allocated if it's not already pointing to a buffer,
so it needs to be kfree'd only if was allocated in query_info, so the
fix adds an allocated flag to track this.  Also set *dlen to zero on
an error just to be safe since *data is kfree'd.

Also set errno to -ENOMEM if the allocation of *data fails.
Signed-off-by: 's avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: 's avatarSteve French <stfrench@microsoft.com>
Reviewed-by: 's avatarDan Carpener <dan.carpenter@oracle.com>
parent 7fbfee7c
......@@ -2816,6 +2816,7 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
int resp_buftype = CIFS_NO_BUFFER;
struct cifs_ses *ses = tcon->ses;
int flags = 0;
bool allocated = false;
cifs_dbg(FYI, "Query Info\n");
......@@ -2855,14 +2856,21 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
"Error %d allocating memory for acl\n",
rc);
*dlen = 0;
rc = -ENOMEM;
goto qinf_exit;
}
allocated = true;
}
}
rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset),
le32_to_cpu(rsp->OutputBufferLength),
&rsp_iov, min_len, *data);
if (rc && allocated) {
kfree(*data);
*data = NULL;
*dlen = 0;
}
qinf_exit:
SMB2_query_info_free(&rqst);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment