diff mbox series

[4.4,04/31] cifs: fix memory leak in smb2_copychunk_range

Message ID	20210524152323.061291491@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Aurelien Aptel <aaptel@suse.com>, Ronnie Sahlberg <lsahlber@redhat.com>, Steve French <stfrench@microsoft.com> Subject: [PATCH 4.4 04/31] cifs: fix memory leak in smb2_copychunk_range Date: Mon, 24 May 2021 17:24:47 +0200 Message-Id: <20210524152323.061291491@linuxfoundation.org> In-Reply-To: <20210524152322.919918360@linuxfoundation.org> References: <20210524152322.919918360@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.4,02/31] scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() [4.4,03/31] ptrace: make ptrace() fail if the tracee changed its pid unexpectedly [4.4,04/31] cifs: fix memory leak in smb2_copychunk_range [4.4,05/31] ALSA: usb-audio: Validate MS endpoint descriptors [4.4,06/31] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro [4.4,07/31] Revert "ALSA: sb8: add a check for request_region" [4.4,08/31] xen-pciback: reconfigure also from backend watch handler [4.4,09/31] dm snapshot: fix a crash when an origin has no snapshots [4.4,10/31] dm snapshot: fix crash with transient storage and zero chunk size [4.4,11/31] Revert "video: hgafb: fix potential NULL pointer dereference" [4.4,12/31] Revert "net: stmicro: fix a missing check of clk_prepare" [4.4,13/31] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" [4.4,14/31] Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" [4.4,15/31] Revert "video: imsttfb: fix potential NULL pointer dereferences" [4.4,16/31] Revert "ecryptfs: replace BUG_ON with error handling code" [4.4,17/31] Revert "gdrom: fix a memory leak bug" [4.4,18/31] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom [4.4,19/31] cdrom: gdrom: initialize global variable at init time [4.4,20/31] Revert "rtlwifi: fix a potential NULL pointer dereference" [4.4,21/31] Revert "qlcnic: Avoid potential NULL pointer dereference" [4.4,22/31] Revert "niu: fix missing checks of niu_pci_eeprom_read" [4.4,23/31] ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() [4.4,24/31] net: stmicro: handle clk_prepare() failure during init [4.4,25/31] net: rtlwifi: properly check for alloc_workqueue() failure [4.4,26/31] leds: lp5523: check return value of lp5xx_read and jump to cleanup code [4.4,27/31] qlcnic: Add null check after calling netdev_alloc_skb [4.4,28/31] video: hgafb: fix potential NULL pointer dereference [4.4,29/31] vgacon: Record video mode changes with VT_RESIZEX [4.4,30/31] vt: Fix character height handling with VT_RESIZEX [4.4,31/31] tty: vt: always invoke vc->vc_sw->con_resize callback

Commit Message

Greg Kroah-Hartman May 24, 2021, 3:24 p.m. UTC

From: Ronnie Sahlberg <lsahlber@redhat.com>

commit d201d7631ca170b038e7f8921120d05eec70d7c5 upstream.

When using smb2_copychunk_range() for large ranges we will
run through several iterations of a loop calling SMB2_ioctl()
but never actually free the returned buffer except for the final
iteration.
This leads to memory leaks everytime a large copychunk is requested.

Fixes: 9bf0c9cd4314 ("CIFS: Fix SMB2/SMB3 Copy offload support (refcopy) for large files")
Cc: <stable@vger.kernel.org>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/smb2ops.c |    2 ++
 1 file changed, 2 insertions(+)

diff mbox series

Patch

--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -619,6 +619,8 @@  smb2_clone_range(const unsigned int xid,
 			cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk));
 
 		/* Request server copy to target from src identified by key */
+		kfree(retbuf);
+		retbuf = NULL;
 		rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
 			trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
 			true /* is_fsctl */, (char *)pcchunk,