linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Aurelien Aptel <aaptel@suse.com>,
	Ronnie Sahlberg <lsahlber@redhat.com>,
	Steve French <stfrench@microsoft.com>
Subject: [PATCH 4.14 05/37] cifs: fix memory leak in smb2_copychunk_range
Date: Mon, 24 May 2021 17:25:09 +0200	[thread overview]
Message-ID: <20210524152324.371904819@linuxfoundation.org> (raw)
In-Reply-To: <20210524152324.199089755@linuxfoundation.org>

From: Ronnie Sahlberg <lsahlber@redhat.com>

commit d201d7631ca170b038e7f8921120d05eec70d7c5 upstream.

When using smb2_copychunk_range() for large ranges we will
run through several iterations of a loop calling SMB2_ioctl()
but never actually free the returned buffer except for the final
iteration.
This leads to memory leaks everytime a large copychunk is requested.

Fixes: 9bf0c9cd4314 ("CIFS: Fix SMB2/SMB3 Copy offload support (refcopy) for large files")
Cc: <stable@vger.kernel.org>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/smb2ops.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -885,6 +885,8 @@ smb2_copychunk_range(const unsigned int
 			cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk));
 
 		/* Request server copy to target from src identified by key */
+		kfree(retbuf);
+		retbuf = NULL;
 		rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
 			trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
 			true /* is_fsctl */, false /* use_ipc */,



  parent reply	other threads:[~2021-05-24 15:39 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-24 15:25 [PATCH 4.14 00/37] 4.14.234-rc1 review Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 01/37] openrisc: Fix a memory leak Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 02/37] RDMA/rxe: Clear all QP fields if creation failed Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 03/37] scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 04/37] ptrace: make ptrace() fail if the tracee changed its pid unexpectedly Greg Kroah-Hartman
2021-05-24 15:25 ` Greg Kroah-Hartman [this message]
2021-05-24 15:25 ` [PATCH 4.14 06/37] ALSA: line6: Fix racy initialization of LINE6 MIDI Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 07/37] ALSA: usb-audio: Validate MS endpoint descriptors Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 08/37] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 09/37] Revert "ALSA: sb8: add a check for request_region" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 10/37] ALSA: hda/realtek: reset eapd coeff to default value for alc287 Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 11/37] Revert "rapidio: fix a NULL pointer dereference when create_workqueue() fails" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 12/37] rapidio: handle create_workqueue() failure Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 13/37] xen-pciback: reconfigure also from backend watch handler Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 14/37] dm snapshot: fix a crash when an origin has no snapshots Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 15/37] dm snapshot: fix crash with transient storage and zero chunk size Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 16/37] Revert "video: hgafb: fix potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 17/37] Revert "net: stmicro: fix a missing check of clk_prepare" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 18/37] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 19/37] Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 20/37] Revert "video: imsttfb: fix potential NULL pointer dereferences" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 21/37] Revert "ecryptfs: replace BUG_ON with error handling code" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 22/37] Revert "gdrom: fix a memory leak bug" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 23/37] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 24/37] cdrom: gdrom: initialize global variable at init time Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 25/37] Revert "media: rcar_drif: fix a memory disclosure" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 26/37] Revert "rtlwifi: fix a potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 27/37] Revert "qlcnic: Avoid " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 28/37] Revert "niu: fix missing checks of niu_pci_eeprom_read" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 29/37] ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 30/37] net: stmicro: handle clk_prepare() failure during init Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 31/37] net: rtlwifi: properly check for alloc_workqueue() failure Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 32/37] leds: lp5523: check return value of lp5xx_read and jump to cleanup code Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 33/37] qlcnic: Add null check after calling netdev_alloc_skb Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 34/37] video: hgafb: fix potential NULL pointer dereference Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 35/37] vgacon: Record video mode changes with VT_RESIZEX Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 36/37] vt: Fix character height handling " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.14 37/37] tty: vt: always invoke vc->vc_sw->con_resize callback Greg Kroah-Hartman
2021-05-25  0:55 ` [PATCH 4.14 00/37] 4.14.234-rc1 review Samuel Zou
2021-05-25 12:06 ` Naresh Kamboju
2021-05-25 21:23 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210524152324.371904819@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=aaptel@suse.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lsahlber@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=stfrench@microsoft.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).