2023-03-02 12:49:55

by ChenXiaoSong

Subject: [PATCH] ksmbd: fix possible refcount leak in smb2_open()

Reference count of acls will leak when memory allocation fails. Fix this
by adding the missing posix_acl_release().

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: ChenXiaoSong <[email protected]>
---
fs/ksmbd/smb2pdu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index 0685c1c77b9f..f04d810a2588 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -2977,8 +2977,11 @@ int smb2_open(struct ksmbd_work *work)
sizeof(struct smb_acl) +
sizeof(struct smb_ace) * ace_num * 2,
GFP_KERNEL);
- if (!pntsd)
+ if (!pntsd) {
+ posix_acl_release(fattr.cf_acls);
+ posix_acl_release(fattr.cf_dacls);
goto err_out;
+ }

rc = build_sec_desc(idmap,
pntsd, NULL, 0,
--
2.31.1

2023-03-07 08:52:57

by ChenXiaoSong

Subject: Re: [PATCH] ksmbd: fix possible refcount leak in smb2_open()

Hi Namjae and Steve:

Do you have any suggestions for this patch?

在 2023/3/2 21:58, ChenXiaoSong 写道:
> Reference count of acls will leak when memory allocation fails. Fix this
> by adding the missing posix_acl_release().
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: ChenXiaoSong <[email protected]>
> ---
> fs/ksmbd/smb2pdu.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
> index 0685c1c77b9f..f04d810a2588 100644
> --- a/fs/ksmbd/smb2pdu.c
> +++ b/fs/ksmbd/smb2pdu.c
> @@ -2977,8 +2977,11 @@ int smb2_open(struct ksmbd_work *work)
> sizeof(struct smb_acl) +
> sizeof(struct smb_ace) * ace_num * 2,
> GFP_KERNEL);
> - if (!pntsd)
> + if (!pntsd) {
> + posix_acl_release(fattr.cf_acls);
> + posix_acl_release(fattr.cf_dacls);
> goto err_out;
> + }
>
> rc = build_sec_desc(idmap,
> pntsd, NULL, 0,
>

2023-03-07 09:24:18

by Namjae Jeon

Subject: Re: [PATCH] ksmbd: fix possible refcount leak in smb2_open()

2023-03-02 22:58 GMT+09:00, ChenXiaoSong <[email protected]>:
> Reference count of acls will leak when memory allocation fails. Fix this
> by adding the missing posix_acl_release().
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: ChenXiaoSong <[email protected]>
Acked-by: Namjae Jeon <[email protected]>

Thanks for your patch!

2023-03-07 09:27:40

by Namjae Jeon

Subject: Re: [PATCH] ksmbd: fix possible refcount leak in smb2_open()

2023-03-07 17:52 GMT+09:00, ChenXiaoSong <[email protected]>:
> Hi Namjae and Steve:
Hi Chen,
>
> Do you have any suggestions for this patch?
Sorry, It was in the spam box...
I have sent ack. Thanks for noticing.
>
> 在 2023/3/2 21:58, ChenXiaoSong 写道:
>> Reference count of acls will leak when memory allocation fails. Fix this
>> by adding the missing posix_acl_release().
>>
>> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
>> Signed-off-by: ChenXiaoSong <[email protected]>
>> ---
>> fs/ksmbd/smb2pdu.c | 5 ++++-
>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
>> index 0685c1c77b9f..f04d810a2588 100644
>> --- a/fs/ksmbd/smb2pdu.c
>> +++ b/fs/ksmbd/smb2pdu.c
>> @@ -2977,8 +2977,11 @@ int smb2_open(struct ksmbd_work *work)
>> sizeof(struct smb_acl) +
>> sizeof(struct smb_ace) * ace_num * 2,
>> GFP_KERNEL);
>> - if (!pntsd)
>> + if (!pntsd) {
>> + posix_acl_release(fattr.cf_acls);
>> + posix_acl_release(fattr.cf_dacls);
>> goto err_out;
>> + }
>>
>> rc = build_sec_desc(idmap,
>> pntsd, NULL, 0,
>>
>