diff options
| author | ZhangGuoDong <zhangguodong@kylinos.cn> | 2026-07-31 11:50:04 +0000 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2026-08-17 15:00:58 +0900 |
| commit | 3ce2f9491963c9c9c02129deaf7e8a0809775e97 (patch) | |
| tree | 698ebbe930b0d7414d4df8da1094922fc5b8c5a6 | |
| parent | d2ccf905f47d2344270749f4dfa905afcd3edeb0 (diff) | |
smb/server: fix memory leak in ksmbd_vfs_set_durable_owner()
See the procedure below:
smb2_open
ksmbd_vfs_set_durable_owner
fp->owner.name = name
// When the connection goes away
ksmbd_sessions_deregister
ksmbd_session_destroy
ksmbd_destroy_file_table
__close_file_table_ids
session_fd_check // skip()
ksmbd_vfs_set_durable_owner
fp->owner.name = name // memory leak
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
| -rw-r--r-- | fs/smb/server/vfs_cache.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c index c28e3d65d64b..5acd06020d42 100644 --- a/fs/smb/server/vfs_cache.c +++ b/fs/smb/server/vfs_cache.c @@ -1655,7 +1655,7 @@ void ksmbd_stop_durable_scavenger(void) int ksmbd_vfs_set_durable_owner(struct ksmbd_file *fp, struct ksmbd_user *user) { - char *name; + char *name, *old_name; if (!user) return -EINVAL; @@ -1666,10 +1666,12 @@ int ksmbd_vfs_set_durable_owner(struct ksmbd_file *fp, return -ENOMEM; spin_lock(&fp->f_lock); + old_name = fp->owner.name; fp->owner.uid = user->uid; fp->owner.gid = user->gid; fp->owner.name = name; spin_unlock(&fp->f_lock); + kfree(old_name); return 0; } |