linux-kernel - [PATCH 3.16 170/410] cifs: fix memory leak when password is supplied multiple times

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 07 Jun 2018 15:05:21 +0100
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org, "Steve French" <smfrench@...il.com>,
        "Namjae Jeon" <namjae.jeon@...sung.com>,
        "Ashish Sangwan" <a.sangwan@...sung.com>
Subject: [PATCH 3.16 170/410] cifs: fix memory leak when password is
 supplied multiple times

3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <namjae.jeon@...sung.com>

commit d6ccf4997e62fb6629f9f003980dca5292138b7b upstream.

Unlikely but possible. When password is supplied multiple times, we have
to free the previous allocation.

Signed-off-by: Namjae Jeon <namjae.jeon@...sung.com>
Signed-off-by: Ashish Sangwan <a.sangwan@...sung.com>
Signed-off-by: Steve French <smfrench@...il.com>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 fs/cifs/connect.c | 2 ++
 1 file changed, 2 insertions(+)

--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1614,6 +1614,7 @@ cifs_parse_mount_options(const char *mou
 			tmp_end++;
 			if (!(tmp_end < end && tmp_end[1] == delim)) {
 				/* No it is not. Set the password to NULL */
+				kfree(vol->password);
 				vol->password = NULL;
 				break;
 			}
@@ -1651,6 +1652,7 @@ cifs_parse_mount_options(const char *mou
 					options = end;
 			}
 
+			kfree(vol->password);
 			/* Now build new password string */
 			temp_len = strlen(value);
 			vol->password = kzalloc(temp_len+1, GFP_KERNEL);