diff options
| author | Paulo Alcantara <pc@manguebit.org> | 2026-02-05 19:19:52 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2026-02-09 02:07:42 +0300 |
| commit | ebbbc4bfad4cb355d17c671223d0814ee3ef4eda (patch) | |
| tree | cb9da8233c242380b0448218f5da8c9f3b777501 /include/linux/panic.h | |
| parent | 05f7e89ab9731565d8a62e3b5d1ec206485eeb0b (diff) | |
| download | linux-ebbbc4bfad4cb355d17c671223d0814ee3ef4eda.tar.xz | |
smb: client: fix potential UAF and double free in smb2_open_file()
Zero out @err_iov and @err_buftype before retrying SMB2_open() to
prevent an UAF bug if @data != NULL, otherwise a double free.
Fixes: e3a43633023e ("smb/client: fix memory leak in smb2_open_file()")
Reported-by: David Howells <dhowells@redhat.com>
Closes: https://lore.kernel.org/r/2892312.1770306653@warthog.procyon.org.uk
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'include/linux/panic.h')
0 files changed, 0 insertions, 0 deletions