]> git.baikalelectronics.ru Git - kernel.git/commit
CIFS: fix use-after-free of the lease keys
authorAurelien Aptel <aaptel@suse.com>
Thu, 31 Jan 2019 12:46:07 +0000 (13:46 +0100)
committerSteve French <stfrench@microsoft.com>
Thu, 31 Jan 2019 13:03:20 +0000 (07:03 -0600)
commit59fccd68503a6d8e26e8a88fb844d95587cb2faa
tree44cd5a49b6e7aadd4cb5bef580ff03164f43344a
parentf4ab810ed74b75d9fd8a5bd7e72dde7164190427
CIFS: fix use-after-free of the lease keys

The request buffers are freed right before copying the pointers.
Use the func args instead which are identical and still valid.

Simple reproducer (requires KASAN enabled) on a cifs mount:

echo foo > foo ; tail -f foo & rm foo

Cc: <stable@vger.kernel.org> # 4.20
Fixes: 14672d7984e2 ("smb3: add tracepoint for sending lease break responses to server")
Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
fs/cifs/smb2pdu.c