samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ksmbd: fix use-after-free in smb2_lock

Browse Source 
commit 84d2d1641b71dec326e8736a749b7ee76a9599fc upstream.

If smb_lock->zero_len has value, ->llist of smb_lock is not delete and
flock is old one. It will cause use-after-free on error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Namjae Jeon
2025-02-26 15:44:02 +09:00
committed by Greg Kroah-Hartman
parent c1569dbbe2
commit 8573571060
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
fs/smb/server/smb2pdu.c
View File

@@ -7442,13 +7442,13 @@ out_check_cl:
}
no_check_cl:
flock = smb_lock->fl;
list_del(&smb_lock->llist);
if (smb_lock->zero_len) {
err = 0;
goto skip;
}
flock = smb_lock->fl;
list_del(&smb_lock->llist);
retry:
rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL);
skip: