linux-kernel - Re: [PATCH] cifs: client: fix memory leak in smb3_fs_context_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANT5p=pC2JShLzXPJG5imWTJBRfXheZeqBhMSpXuOw3rBkRxEw@mail.gmail.com>
Date: Sat, 8 Nov 2025 09:58:46 +0530
From: Shyam Prasad N <nspmangalore@...il.com>
To: Steve French <smfrench@...il.com>
Cc: Paulo Alcantara <pc@...guebit.org>, Edward Adam Davis <eadavis@...com>, 
	syzbot+72afd4c236e6bc3f4bac@...kaller.appspotmail.com, 
	linux-cifs@...r.kernel.org, sprasad@...rosoft.com, 
	syzkaller-bugs@...glegroups.com, samba-technical@...ts.samba.org, 
	linux-kernel@...r.kernel.org, sfrench@...ba.org, bharathsm@...rosoft.com, 
	tom@...pey.com
Subject: Re: [PATCH] cifs: client: fix memory leak in smb3_fs_context_parse_param

On Sat, Nov 8, 2025 at 4:52 AM Steve French <smfrench@...il.com> wrote:
>
> merged into cifs-2.6.git for-next pending additional testing.
>
> Also added Cc:stable tag
>
> On Fri, Nov 7, 2025 at 8:52 AM Paulo Alcantara via samba-technical
> <samba-technical@...ts.samba.org> wrote:
> >
> > Edward Adam Davis <eadavis@...com> writes:
> >
> > > The user calls fsconfig twice, but when the program exits, free() only
> > > frees ctx->source for the second fsconfig, not the first.
> > > Regarding fc->source, there is no code in the fs context related to its
> > > memory reclamation.
> > >
> > > To fix this memory leak, release the source memory corresponding to ctx
> > > or fc before each parsing.
> > >
> > > syzbot reported:
> > > BUG: memory leak
> > > unreferenced object 0xffff888128afa360 (size 96):
> > >   backtrace (crc 79c9c7ba):
> > >     kstrdup+0x3c/0x80 mm/util.c:84
> > >     smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444
> > >
> > > BUG: memory leak
> > > unreferenced object 0xffff888112c7d900 (size 96):
> > >   backtrace (crc 79c9c7ba):
> > >     smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629
> > >     smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438
> > >
> > > Reported-by: syzbot+72afd4c236e6bc3f4bac@...kaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac
> > > Signed-off-by: Edward Adam Davis <eadavis@...com>
> > > ---
> > >  fs/smb/client/fs_context.c | 2 ++
> > >  1 file changed, 2 insertions(+)
> >
> > Reviewed-by: Paulo Alcantara (Red Hat) <pc@...guebit.org>
> >
>
>
> --
> Thanks,
>
> Steve
>

Looks good to me.
Steve, this is one of the mount options that is missing in the man page.
Also, I don't understand this option. Why is it needed? Don't we
specify the source in the mount command as devname anyway?

-- 
Regards,
Shyam