Re: [PATCH] smb: client: fix potential UAF and double free it smb2_open_file()

[ChenXiaoSong <chenxiaosong.chenxiaosong@linux.dev>]

Looks good. Feel free to add:

Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>

On 2/6/26 12:19 AM, Paulo Alcantara wrote:
> Zero out @err_iov and @err_buftype before retrying SMB2_open() to
> prevent an UAF bug if @data != NULL, otherwise a double free.
> 
> Fixes: e3a43633023e ("smb/client: fix memory leak in smb2_open_file()")
> Reported-by: David Howells <dhowells@redhat.com>
> Closes: https://lore.kernel.org/r/2892312.1770306653@warthog.procyon.org.uk
> Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
> Reviewed-by: David Howells <dhowells@redhat.com>
> Cc: ChenXiaoSong <chenxiaosong@kylinos.cn>
> Cc: linux-cifs@vger.kernel.org
> ---
>   fs/smb/client/smb2file.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c
> index 2dd08388ea87..1f7f284a7844 100644
> --- a/fs/smb/client/smb2file.c
> +++ b/fs/smb/client/smb2file.c
> @@ -179,6 +179,8 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
>   		       &err_buftype);
>   	if (rc == -EACCES && retry_without_read_attributes) {
>   		free_rsp_buf(err_buftype, err_iov.iov_base);
> +		memset(&err_iov, 0, sizeof(err_iov));
> +		err_buftype = CIFS_NO_BUFFER;
>   		oparms->desired_access &= ~FILE_READ_ATTRIBUTES;
>   		rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, smb2_data, NULL, &err_iov,
>   			       &err_buftype);