Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #63600

Bug#919290: SMB2_close_free: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000

Cross-posted to 2 groups.

Show all headers | View raw

The corresponding patch has been merged in the 4.19 branch
and is released as 4.19.29.

commit b4d965a37d89cd8611984ea16c85903d01ac967a
Author:     Ronnie Sahlberg <lsahlber@redhat.com>
AuthorDate: Wed Oct 24 11:50:33 2018 +1000
Commit:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CommitDate: Wed Mar 13 14:02:40 2019 -0700

    cifs: allow calling SMB2_xxx_free(NULL)
    
    commit 32a1fb36f6e50183871c2c1fcf5493c633e84732 upstream.
    
    Change these free functions to allow passing NULL as the argument and
    treat it as a no-op just like free(NULL) would.
    Or, if rqst->rq_iov is NULL.
    
    The second scenario could happen for smb2_queryfs() if the call
    to SMB2_query_info_init() fails and we go to qfs_exit to clean up
    and free all resources.
    In that case we have not yet assigned rqst[2].rq_iov and thus
    the rq_iov dereference in SMB2_close_free() will cause a NULL pointer
    dereference.
    
    [ bp: upstream patch also fixes SMB2_set_info_free which was introduced in 4.20 ]
    
    Fixes:  1eb9fb52040f ("cifs: create SMB2_open_init()/SMB2_open_free() helpers")
    
    Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Reviewed-by: Aurelien Aptel <aaptel@suse.com>
    CC: Stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Back to linux.debian.kernel | Previous | Next | Find similar | Unroll thread

Thread

Bug#919290: SMB2_close_free: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 Remy Oudompheng <oudomphe@phare.normalesup.org> - 2019-03-14 09:20 +0100

csiph-web