tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'v6.19-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

- Fix memory leak

- Fix two refcount leaks

- Fix error path in create_smb2_pipe

* tag 'v6.19-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd:
smb/server: fix refcount leak in smb2_open()
smb/server: fix refcount leak in parse_durable_handle_context()
smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
ksmbd: Fix memory leak in get_file_all_info()

Linus Torvalds e3a97ab1 047b4e78

+9 -3
+9 -3
fs/smb/server/smb2pdu.c
··· 2281 2281 { 2282 2282 struct smb2_create_rsp *rsp; 2283 2283 struct smb2_create_req *req; 2284 - int id; 2284 + int id = -1; 2285 2285 int err; 2286 2286 char *name; 2287 2287 ··· 2337 2337 rsp->hdr.Status = STATUS_NO_MEMORY; 2338 2338 break; 2339 2339 } 2340 + 2341 + if (id >= 0) 2342 + ksmbd_session_rpc_close(work->sess, id); 2340 2343 2341 2344 if (!IS_ERR(name)) 2342 2345 kfree(name); ··· 2812 2809 SMB2_CLIENT_GUID_SIZE)) { 2813 2810 if (!(req->hdr.Flags & SMB2_FLAGS_REPLAY_OPERATION)) { 2814 2811 err = -ENOEXEC; 2812 + ksmbd_put_durable_fd(dh_info->fp); 2815 2813 goto out; 2816 2814 } 2817 2815 ··· 3010 3006 file_info = FILE_OPENED; 3011 3007 3012 3008 rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat); 3009 + ksmbd_put_durable_fd(fp); 3013 3010 if (rc) 3014 3011 goto err_out2; 3015 3012 3016 - ksmbd_put_durable_fd(fp); 3017 3013 goto reconnected_fp; 3018 3014 } 3019 3015 } else if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) ··· 4927 4923 4928 4924 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 4929 4925 AT_STATX_SYNC_AS_STAT); 4930 - if (ret) 4926 + if (ret) { 4927 + kfree(filename); 4931 4928 return ret; 4929 + } 4932 4930 4933 4931 ksmbd_debug(SMB, "filename = %s\n", filename); 4934 4932 delete_pending = ksmbd_inode_pending_delete(fp);