fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free
authorMurphy Zhou <jencce.kernel@gmail.com>
Thu, 23 May 2019 04:12:43 +0000 (12:12 +0800)
committerSteve French <stfrench@microsoft.com>
Wed, 29 May 2019 00:11:35 +0000 (19:11 -0500)
commit6457c20e336867fc90286d35bddcc9c0b0aaa936
tree9e545a3cd099b42f42683652c59dd11e5487b8b0
parent210782038b54ec8e9059a3c12d6f6ae173efa3a9
fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free

The 2nd buffer could be NULL even if iov_len is not zero. This can
trigger a panic when handling symlinks. It's easy to reproduce with
LTP fs_racer scripts[1] which are randomly craete/delete/link files
and dirs. Fix this panic by checking if the 2nd buffer is padding
before kfree, like what we do in SMB2_open_free.

[1] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/fs/racer

Fixes: 2c87d6a94d16 ("cifs: Allocate memory for all iovs in smb2_ioctl")
Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Ronnie sahlberg <lsahlber@redhat.com>
fs/cifs/smb2pdu.c