Commit 1903e6d0 authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French

ksmbd: fix potential double free on smb2_read_pipe() error path

Fix new smatch warnings:
fs/smb/server/smb2pdu.c:6131 smb2_read_pipe() error: double free of 'rpc_resp'

Fixes: e2b76ab8 ("ksmbd: add support for read compound")
Reported-by: default avatarkernel test robot <lkp@intel.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 41484904
...@@ -6152,12 +6152,12 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work) ...@@ -6152,12 +6152,12 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work)
memcpy(aux_payload_buf, rpc_resp->payload, rpc_resp->payload_sz); memcpy(aux_payload_buf, rpc_resp->payload, rpc_resp->payload_sz);
nbytes = rpc_resp->payload_sz; nbytes = rpc_resp->payload_sz;
kvfree(rpc_resp);
err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, err = ksmbd_iov_pin_rsp_read(work, (void *)rsp,
offsetof(struct smb2_read_rsp, Buffer), offsetof(struct smb2_read_rsp, Buffer),
aux_payload_buf, nbytes); aux_payload_buf, nbytes);
if (err) if (err)
goto out; goto out;
kvfree(rpc_resp);
} else { } else {
err = ksmbd_iov_pin_rsp(work, (void *)rsp, err = ksmbd_iov_pin_rsp(work, (void *)rsp,
offsetof(struct smb2_read_rsp, Buffer)); offsetof(struct smb2_read_rsp, Buffer));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment