Skip to contentSkip to conversation

cifs: fix memory leak when password is supplied multiple times

PATCH Applied Namjae Jeon 2 participants 2 messages Aug 21, 2014

Subsystems (2)
SMB client (CIFS) Kernel SMB3 server (ksmbd)
lore
Share & tools
lore

Namjae Jeon

author
#0 lore raw

PATCH v2 1/1 cifs: fix memory leak when password is supplied multiple times

Unlikely but possible. When password is supplied multiple times, we have to free the previous allocation.

Signed-off-by Namjae Jeon <[email protected]>
Signed-off-by Ashish Sangwan <[email protected]>

---
Changelog
v2:
- fix a possible double free reported by kbuild.

 fs/cifs/connect.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
fs/cifs/connect.c +2 -0
index b4b6d10..8a9fded 100644
@@ -1587,6 +1587,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 			tmp_end++;
 			if (!(tmp_end < end && tmp_end[1] == delim)) {
 				/* No it is not. Set the password to NULL */
+				kfree(vol->password);
 				vol->password = NULL;
 				break;
 			}

@@ -1624,6 +1625,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 					options = end;
 			}
 
+			kfree(vol->password);
 			/* Now build new password string */
 			temp_len = strlen(value);
 			vol->password = kzalloc(temp_len+1, GFP_KERNEL);
Signature · 1 line
1.7.7
Applied
#1 lore raw

merged into cifs-2.6.git

Of the 7 patch series, only the ntlmv2 security fix has not been merged (would like additional information/thoughts on this - perhaps some experiments with windows to see what the time threshold is)

Quoted 36 lines · Namjae Jeon

Unlikely but possible. When password is supplied multiple times, we have to free the previous allocation.

Signed-off-by Namjae Jeon <[email protected]>
Signed-off-by Ashish Sangwan <[email protected]>

---
Changelog
v2:
- fix a possible double free reported by kbuild.

 fs/cifs/connect.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
fs/cifs/connect.c +2 -1
index b4b6d10..8a9fded 100644
@@ -1587,6 +1587,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                        tmp_end++;
                        if (!(tmp_end < end && tmp_end[1] == delim)) {
                                /* No it is not. Set the password to NULL */
+                               kfree(vol->password);
                                vol->password = NULL;
                                break;
                        }

@@ -1624,6 +1625,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                        options = end;
                        }
 
+                       kfree(vol->password);
                        /* Now build new password string */
                        temp_len = strlen(value);
                        vol->password = kzalloc(temp_len+1, GFP_KERNEL);
--

1.7.7

Signature · 3 lines
Thanks,

Steve