stable inclusion from stable-v5.10.238 commit efe12747997bce7be9e9a13731ccba7b38403083 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICI62O CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- commit e48f9d849bfdec276eebf782a84fd4dfbe1c14c0 upstream. Multiple pointers in struct cifs_search_info (ntwrk_buf_start, srch_entries_start, and last_entry) point to the same allocated buffer. However, when freeing this buffer, only ntwrk_buf_start was set to NULL, while the other pointers remained pointing to freed memory. This is defensive programming to prevent potential issues with stale pointers. While the active UAF vulnerability is fixed by the previous patch, this change ensures consistent pointer state and more robust error handling. Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Conflicts: fs/cifs/readdir.c [Conflicts with mainline commit d1542cf6165e ("cifs: compute full_path lready in cifs_readdir()").] Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> --- fs/cifs/readdir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c index 157aae931a18..c3156f602b20 100644 --- a/fs/cifs/readdir.c +++ b/fs/cifs/readdir.c @@ -619,11 +619,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, cifs_small_buf_release(cfile->srch_inf. ntwrk_buf_start); else cifs_buf_release(cfile->srch_inf. ntwrk_buf_start); + /* Reset all pointers to the network buffer to prevent stale references */ cfile->srch_inf.ntwrk_buf_start = NULL; + cfile->srch_inf.srch_entries_start = NULL; + cfile->srch_inf.last_entry = NULL; } rc = initiate_cifs_search(xid, file); if (rc) { cifs_dbg(FYI, "error %d reinitiating a search on rewind\n", rc); -- 2.34.3