shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 02:21:52 +09:00
Code Issues Packages Projects Releases Wiki Activity

ksmbd: fix use-after-free in smb2_lock

Browse Source 
commit 84d2d1641b71dec326e8736a749b7ee76a9599fc upstream.

If smb_lock->zero_len has value, ->llist of smb_lock is not delete and
flock is old one. It will cause use-after-free on error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Namjae Jeon
2025-02-26 15:44:02 +09:00
committed by Greg Kroah-Hartman
parent 6321bbda42
commit 410ce35a2e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
fs/smb/server/smb2pdu.c
View File

@@ -7124,13 +7124,13 @@ out_check_cl:
} }
no_check_cl: no_check_cl:
flock = smb_lock->fl;
list_del(&smb_lock->llist);
if (smb_lock->zero_len) { if (smb_lock->zero_len) {
err = 0; err = 0;
goto skip; goto skip;
} }
flock = smb_lock->fl;
list_del(&smb_lock->llist);
retry: retry:
rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL); rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL);
skip: skip: