On Thu, May 23, 2019 at 2:14 PM Murphy Zhou <jencce.kernel@xxxxxxxxx> wrote: > > The 2nd buffer could be NULL even if iov_len is not zero. This can > trigger a panic when handling symlinks. It's easy to reproduce with > LTP fs_racer scripts[1] which are randomly craete/delete/link files > and dirs. Fix this panic by checking if the 2nd buffer is padding > before kfree, like what we do in SMB2_open_free. Looks good. Reviewed-by: Ronnie Sahlberg <lsahlber@xxxxxxxxxx> > > [1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer > > Fixes: 2c87d6a ("cifs: Allocate memory for all iovs in smb2_ioctl") > Signed-off-by: Murphy Zhou <jencce.kernel@xxxxxxxxx> > --- > fs/cifs/smb2pdu.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c > index 710ceb8..c36f940 100644 > --- a/fs/cifs/smb2pdu.c > +++ b/fs/cifs/smb2pdu.c > @@ -2619,10 +2619,12 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, > void > SMB2_ioctl_free(struct smb_rqst *rqst) > { > + int i; > if (rqst && rqst->rq_iov) { > cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ > - if (rqst->rq_iov[1].iov_len) > - kfree(rqst->rq_iov[1].iov_base); > + for (i = 1; i < rqst->rq_nvec; i++) > + if (rqst->rq_iov[i].iov_base != smb2_padding) > + kfree(rqst->rq_iov[i].iov_base); > } > } > > -- > 1.8.3.1 >
