Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2;
MIME-Version: 1.0
In-Reply-To: <20231201145048.2179969-1-wozizhi@huawei.com>
References: <20231201145048.2179969-1-wozizhi@huawei.com>
From:   Namjae Jeon <linkinjeon@kernel.org>
Date:   Sat, 2 Dec 2023 12:54:30 +0900
Message-ID: <CAKYAXd-6AfN8PUZWafHHg8xeH+7T5CLFtjs+4Snb=smiDHJgqQ@mail.gmail.com>
Subject: Re: [PATCH -next] ksmbd: fix memory leak in smb2_lock()
To:     Zizhi Wo <wozizhi@huawei.com>
Cc:     sfrench@samba.org, senozhatsky@chromium.org, lsahlber@redhat.com,
        hyc.lee@gmail.com, linux-cifs@vger.kernel.org,
        linux-kernel@vger.kernel.org, yangerkun@huawei.com
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

2023-12-01 23:50 GMT+09:00, Zizhi Wo <wozizhi@huawei.com>:
> In smb2_lock(), if setup_async_work() executes successfully,
> work->cancel_argv will bind the argv that generated by kmalloc(). And
> release_async_work() is called in ksmbd_conn_try_dequeue_request() or
> smb2_lock() to release argv.
> However, when setup_async_work function fails, work->cancel_argv has not
> been bound to the argv, resulting in the previously allocated argv not
> being released. Call kfree() to fix it.
>
> when setup_async_work fails, the code will go to the
> "out" branch, resulting in the previously allocated "argv" not being
> released. Call kfree() to fix it.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>

Applied it to #ksmbd-for-next-next .
Thanks.