From: Marios Makassikis mmakassikis@freebox.fr
mainline inclusion from mainline-5.15-rc1 commit 915f570a971b4e5abd95e8b169dd41c120ab5a5b category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I60T7G CVE: NA
Reference: https://git.kernel.org/torvalds/linux/c/915f570a971b
-------------------------------
smb2_put_name() is called twice, and both call sites do the IS_ERR() check before.
Signed-off-by: Marios Makassikis mmakassikis@freebox.fr Signed-off-by: Namjae Jeon namjae.jeon@samsung.com Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Jason Yan yanaijie@huawei.com Signed-off-by: Zhong Jinghua zhongjinghua@huawei.com --- fs/cifsd/smb2pdu.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
diff --git a/fs/cifsd/smb2pdu.c b/fs/cifsd/smb2pdu.c index 08b06ec97e22..1ff0b20ff7b8 100644 --- a/fs/cifsd/smb2pdu.c +++ b/fs/cifsd/smb2pdu.c @@ -666,16 +666,6 @@ smb2_get_name(struct ksmbd_share_config *share, const char *src, return unixname; }
-/** - * smb2_put_name() - free memory allocated for filename - * @name: filename pointer to be freed - */ -static void smb2_put_name(void *name) -{ - if (!IS_ERR(name)) - kfree(name); -} - int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg) { struct smb2_hdr *rsp_hdr; @@ -5418,7 +5408,7 @@ static int smb2_rename(struct ksmbd_work *work, struct ksmbd_file *fp, out: kfree(pathname); if (!IS_ERR(new_name)) - smb2_put_name(new_name); + kfree(new_name); return rc; }
@@ -5483,7 +5473,7 @@ static int smb2_create_link(struct ksmbd_work *work, rc = -EINVAL; out: if (!IS_ERR(link_name)) - smb2_put_name(link_name); + kfree(link_name); kfree(pathname); return rc; }