linux-kernel - Re: [PATCH] ksmbd: Fix memory leak in get_file_all

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <694C9AB5.9000009@huaweicloud.com>
Date: Thu, 25 Dec 2025 10:00:21 +0800
From: yebin <yebin@...weicloud.com>
To: Zilin Guan <zilin@....edu.cn>, linkinjeon@...nel.org
Cc: smfrench@...il.com, senozhatsky@...omium.org, tom@...pey.com,
 linux-cifs@...r.kernel.org, linux-kernel@...r.kernel.org,
 jianhao.xu@....edu.cn
Subject: Re: [PATCH] ksmbd: Fix memory leak in get_file_all_info()



On 2025/12/24 22:20, Zilin Guan wrote:
> In get_file_all_info(), if vfs_getattr() fails, the function returns
> immediately without freeing the allocated filename, leading to a memory
> leak.
>
> Fix this by freeing the filename before returning in this error case.
>
> Fixes: 5614c8c487f6a ("ksmbd: replace generic_fillattr with vfs_getattr")
> Signed-off-by: Zilin Guan <zilin@....edu.cn>
> ---
>   fs/smb/server/smb2pdu.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
> index 8aa483800014..4472638ab11a 100644
> --- a/fs/smb/server/smb2pdu.c
> +++ b/fs/smb/server/smb2pdu.c
> @@ -4923,8 +4923,10 @@ static int get_file_all_info(struct ksmbd_work *work,
>
>   	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
>   			  AT_STATX_SYNC_AS_STAT);
> -	if (ret)
> +	if (ret) {
		goto out;
> +		kfree(filename);
>   		return ret;
> +	}
>
out:
          kfree(filename);
          return ret;

Maybe we can add 'out' label.

>   	ksmbd_debug(SMB, "filename = %s\n", filename);
>   	delete_pending = ksmbd_inode_pending_delete(fp);
>