linux-kernel - Re: [PATCH] cifs: client: fix memory leak in smb3_fs_context_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f25e47415998a9d9360ac87eca7292a2@manguebit.org>
Date: Fri, 07 Nov 2025 11:30:46 -0300
From: Paulo Alcantara <pc@...guebit.org>
To: Edward Adam Davis <eadavis@...com>,
 syzbot+72afd4c236e6bc3f4bac@...kaller.appspotmail.com
Cc: bharathsm@...rosoft.com, linux-cifs@...r.kernel.org,
 linux-kernel@...r.kernel.org, ronniesahlberg@...il.com,
 samba-technical@...ts.samba.org, sfrench@...ba.org, sprasad@...rosoft.com,
 syzkaller-bugs@...glegroups.com, tom@...pey.com
Subject: Re: [PATCH] cifs: client: fix memory leak in
 smb3_fs_context_parse_param

Edward Adam Davis <eadavis@...com> writes:

> The user calls fsconfig twice, but when the program exits, free() only
> frees ctx->source for the second fsconfig, not the first.
> Regarding fc->source, there is no code in the fs context related to its
> memory reclamation.
>
> To fix this memory leak, release the source memory corresponding to ctx
> or fc before each parsing.
>
> syzbot reported:
> BUG: memory leak
> unreferenced object 0xffff888128afa360 (size 96):
>   backtrace (crc 79c9c7ba):
>     kstrdup+0x3c/0x80 mm/util.c:84
>     smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444
>
> BUG: memory leak
> unreferenced object 0xffff888112c7d900 (size 96):
>   backtrace (crc 79c9c7ba):
>     smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629
>     smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438
>
> Reported-by: syzbot+72afd4c236e6bc3f4bac@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac
> Signed-off-by: Edward Adam Davis <eadavis@...com>
> ---
>  fs/smb/client/fs_context.c | 2 ++
>  1 file changed, 2 insertions(+)

Reviewed-by: Paulo Alcantara (Red Hat) <pc@...guebit.org>