* [PATCH 00/12] cifs: various fixes for NULL pointers
@ 2017-10-11 1:59 Ronnie Sahlberg
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
0 siblings, 1 reply; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
List, Steve
We recently had two very similar issues of dereferencing uninitialized pointer
when Sendreceive2() would have certain failures.
I went through the rest of smb2pdu.c to check for similar issues.
These are what I found. Including a memory leak in smb2_lockv().
These patches are all small and kept separate for review.
It might make sense to collapse all these patches into a single one. I don't
know. Up to you.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH 01/12] cifs: initialize rsp_iov in SMB2_negotiate
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 02/12] cifs: initialize rsp_iov in SMB2_ioctl and check for NULL before deref Ronnie Sahlberg
` (10 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Initialize rsp_iov so that when rsp is assigned we know it is either NULL
or a valid pointer.
Otherwise, if SendReceive2() returns an error without setting rsp_iov
we could end up calling free_rsp_buf() on an uninitialized pointer.
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 6ff4c275ca9a..08701b6125b9 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -470,7 +470,7 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
struct smb2_negotiate_req *req;
struct smb2_negotiate_rsp *rsp;
struct kvec iov[1];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
struct TCP_Server_Info *server = ses->server;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 02/12] cifs: initialize rsp_iov in SMB2_ioctl and check for NULL before deref
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-10-11 1:59 ` [PATCH 01/12] cifs: initialize rsp_iov in SMB2_negotiate Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 03/12] cifs: initialize rsp_iov in SMB2_close Ronnie Sahlberg
` (9 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 08701b6125b9..bf35755501e3 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1884,7 +1884,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
struct smb2_sync_hdr *shdr;
struct cifs_ses *ses;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buftype;
int n_iov;
int rc = 0;
@@ -1981,6 +1981,8 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
rc = SendReceive2(xid, ses, iov, n_iov, &resp_buftype, flags, &rsp_iov);
cifs_small_buf_release(req);
rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
+ if (rsp == NULL)
+ goto ioctl_exit;
if ((rc != 0) && (rc != -EINVAL)) {
cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 03/12] cifs: initialize rsp_iov in SMB2_close
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-10-11 1:59 ` [PATCH 01/12] cifs: initialize rsp_iov in SMB2_negotiate Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 02/12] cifs: initialize rsp_iov in SMB2_ioctl and check for NULL before deref Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 04/12] cifs: initialize rsp_iov in SMB2_query_info Ronnie Sahlberg
` (8 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed.
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index bf35755501e3..acadbdbfc8cb 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2066,7 +2066,7 @@ SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
struct smb2_close_rsp *rsp;
struct cifs_ses *ses = tcon->ses;
struct kvec iov[1];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buftype;
int rc = 0;
int flags = 0;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 04/12] cifs: initialize rsp_iov in SMB2_query_info
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (2 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 03/12] cifs: initialize rsp_iov in SMB2_close Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 05/12] cifs: initialize rsp_iov in SMB2_flush Ronnie Sahlberg
` (7 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index acadbdbfc8cb..97dc913b8dd7 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2170,9 +2170,9 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
u32 *dlen)
{
struct smb2_query_info_req *req;
- struct smb2_query_info_rsp *rsp = NULL;
+ struct smb2_query_info_rsp *rsp;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
struct cifs_ses *ses = tcon->ses;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 05/12] cifs: initialize rsp_iov in SMB2_flush
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (3 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 04/12] cifs: initialize rsp_iov in SMB2_query_info Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 06/12] cifs: initialize rsp_iov in SMB2_read and add check for NULL Ronnie Sahlberg
` (6 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 97dc913b8dd7..ca861ee4ac0a 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2406,7 +2406,7 @@ SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
struct smb2_flush_req *req;
struct cifs_ses *ses = tcon->ses;
struct kvec iov[1];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buftype;
int rc = 0;
int flags = 0;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 06/12] cifs: initialize rsp_iov in SMB2_read and add check for NULL
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (4 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 05/12] cifs: initialize rsp_iov in SMB2_flush Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 07/12] cifs: initialize rsp_iov in SMB2_write Ronnie Sahlberg
` (5 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index ca861ee4ac0a..96a6ed9c86d4 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2641,10 +2641,10 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
{
int resp_buftype, rc = -EACCES;
struct smb2_read_plain_req *req = NULL;
- struct smb2_read_rsp *rsp = NULL;
+ struct smb2_read_rsp *rsp;
struct smb2_sync_hdr *shdr;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
unsigned int total_len;
__be32 req_len;
struct smb_rqst rqst = { .rq_iov = iov,
@@ -2671,6 +2671,10 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
cifs_small_buf_release(req);
rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
+ if (rsp == NULL) {
+ cifs_dbg(VFS, "rsp is NULL in read\n");
+ return -EIO;
+ }
shdr = get_sync_hdr(rsp);
if (shdr->Status == STATUS_END_OF_FILE) {
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 07/12] cifs: initialize rsp_iov in SMB2_write
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (5 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 06/12] cifs: initialize rsp_iov in SMB2_read and add check for NULL Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 08/12] cifs: initialize rsp_iov in SMB2_query_directory Ronnie Sahlberg
` (4 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 96a6ed9c86d4..21ffeb5f5e4b 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2862,9 +2862,9 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
{
int rc = 0;
struct smb2_write_req *req = NULL;
- struct smb2_write_rsp *rsp = NULL;
+ struct smb2_write_rsp *rsp;
int resp_buftype;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int flags = 0;
*nbytes = 0;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 08/12] cifs: initialize rsp_iov in SMB2_query_directory
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (6 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 07/12] cifs: initialize rsp_iov in SMB2_write Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 09/12] cifs: initialize rsp_iov in send_set_info Ronnie Sahlberg
` (3 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 21ffeb5f5e4b..b7f59f536fd7 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2969,7 +2969,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
struct smb2_query_directory_req *req;
struct smb2_query_directory_rsp *rsp = NULL;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int len;
int resp_buftype = CIFS_NO_BUFFER;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 09/12] cifs: initialize rsp_iov in send_set_info
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (7 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 08/12] cifs: initialize rsp_iov in SMB2_query_directory Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 10/12] cifs: initialize rsp_iov in SMB2_QFS_info Ronnie Sahlberg
` (2 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index b7f59f536fd7..93ecaa050c57 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3099,9 +3099,9 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
void **data, unsigned int *size)
{
struct smb2_set_info_req *req;
- struct smb2_set_info_rsp *rsp = NULL;
+ struct smb2_set_info_rsp *rsp;
struct kvec *iov;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
unsigned int i;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 10/12] cifs: initialize rsp_iov in SMB2_QFS_info
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (8 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 09/12] cifs: initialize rsp_iov in send_set_info Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 11/12] cifs: initialize rsp_iov in SMB2_QFS_attr Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 12/12] cifs: initialize rsp_iov in smb2_lockv and fix a memory leak Ronnie Sahlberg
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 93ecaa050c57..f3cc9dbd6fd4 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3382,9 +3382,9 @@ int
SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
{
- struct smb2_query_info_rsp *rsp = NULL;
+ struct smb2_query_info_rsp *rsp;
struct kvec iov;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype;
struct cifs_ses *ses = tcon->ses;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 11/12] cifs: initialize rsp_iov in SMB2_QFS_attr
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (9 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 10/12] cifs: initialize rsp_iov in SMB2_QFS_info Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 12/12] cifs: initialize rsp_iov in smb2_lockv and fix a memory leak Ronnie Sahlberg
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Or else we might call free_rsp_buf() on an uninitialized pointer if
SendReceive2() failed
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index f3cc9dbd6fd4..9dc350fc283d 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3425,9 +3425,9 @@ int
SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
u64 persistent_fid, u64 volatile_fid, int level)
{
- struct smb2_query_info_rsp *rsp = NULL;
+ struct smb2_query_info_rsp *rsp;
struct kvec iov;
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int rc = 0;
int resp_buftype, max_len, min_len;
struct cifs_ses *ses = tcon->ses;
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH 12/12] cifs: initialize rsp_iov in smb2_lockv and fix a memory leak
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
` (10 preceding siblings ...)
2017-10-11 1:59 ` [PATCH 11/12] cifs: initialize rsp_iov in SMB2_QFS_attr Ronnie Sahlberg
@ 2017-10-11 1:59 ` Ronnie Sahlberg
11 siblings, 0 replies; 13+ messages in thread
From: Ronnie Sahlberg @ 2017-10-11 1:59 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French
Signed-off-by: Ronnie Sahlberg <lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/cifs/smb2pdu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 9dc350fc283d..fd2b2b8e86b0 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3498,7 +3498,7 @@ smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
int rc = 0;
struct smb2_lock_req *req = NULL;
struct kvec iov[2];
- struct kvec rsp_iov;
+ struct kvec rsp_iov = { NULL, 0 };
int resp_buf_type;
unsigned int count;
int flags = CIFS_NO_RESP;
@@ -3531,6 +3531,7 @@ smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
rc = SendReceive2(xid, tcon->ses, iov, 2, &resp_buf_type, flags,
&rsp_iov);
cifs_small_buf_release(req);
+ free_rsp_buf(resp_buf_type, rsp_iov.iov_base);
if (rc) {
cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
--
2.13.3
^ permalink raw reply related [flat|nested] 13+ messages in thread
end of thread, other threads:[~2017-10-11 1:59 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-11 1:59 [PATCH 00/12] cifs: various fixes for NULL pointers Ronnie Sahlberg
[not found] ` <20171011015927.7669-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-10-11 1:59 ` [PATCH 01/12] cifs: initialize rsp_iov in SMB2_negotiate Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 02/12] cifs: initialize rsp_iov in SMB2_ioctl and check for NULL before deref Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 03/12] cifs: initialize rsp_iov in SMB2_close Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 04/12] cifs: initialize rsp_iov in SMB2_query_info Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 05/12] cifs: initialize rsp_iov in SMB2_flush Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 06/12] cifs: initialize rsp_iov in SMB2_read and add check for NULL Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 07/12] cifs: initialize rsp_iov in SMB2_write Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 08/12] cifs: initialize rsp_iov in SMB2_query_directory Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 09/12] cifs: initialize rsp_iov in send_set_info Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 10/12] cifs: initialize rsp_iov in SMB2_QFS_info Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 11/12] cifs: initialize rsp_iov in SMB2_QFS_attr Ronnie Sahlberg
2017-10-11 1:59 ` [PATCH 12/12] cifs: initialize rsp_iov in smb2_lockv and fix a memory leak Ronnie Sahlberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox