From: ChenXiaoSong <chenxiaosong@chenxiaosong.com>
To: Werner Kasselman <werner@verivus.ai>,
Namjae Jeon <linkinjeon@kernel.org>,
Steve French <smfrench@gmail.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>,
Tom Talpey <tom@talpey.com>,
"linux-cifs@vger.kernel.org" <linux-cifs@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH] ksmbd: fix memory leaks and NULL deref in smb2_lock()
Date: Tue, 17 Mar 2026 17:29:49 +0800 [thread overview]
Message-ID: <9192ff4b-770a-411b-af5d-ab06d20248f8@chenxiaosong.com> (raw)
In-Reply-To: <20260317080835.1947664-1-werner@verivus.com>
And it might be better to change it as follows.
```
@@ -7685,13 +7686,17 @@ int smb2_lock(struct ksmbd_work *work)
struct file_lock *rlock = NULL;
rlock = smb_flock_init(filp);
- rlock->c.flc_type = F_UNLCK;
- rlock->fl_start = smb_lock->start;
- rlock->fl_end = smb_lock->end;
+ if (rlock) {
+ rlock->c.flc_type = F_UNLCK;
+ rlock->fl_start = smb_lock->start;
+ rlock->fl_end = smb_lock->end;
- rc = vfs_lock_file(filp, F_SETLK, rlock, NULL);
- if (rc)
- pr_err("rollback unlock fail : %d\n", rc);
+ rc = vfs_lock_file(filp, F_SETLK, rlock, NULL);
+ if (rc)
+ pr_err("rollback unlock fail : %d\n", rc);
+ } else {
+ pr_err("rollback unlock alloc failed\n");
+ }
list_del(&smb_lock->llist);
spin_lock(&work->conn->llist_lock);
@@ -7701,7 +7706,8 @@ int smb2_lock(struct ksmbd_work *work)
spin_unlock(&work->conn->llist_lock);
locks_free_lock(smb_lock->fl);
- locks_free_lock(rlock);
+ if (rlock)
+ locks_free_lock(rlock);
kfree(smb_lock);
}
out2:
```
Thanks,
ChenXiaoSong <chenxiaosong@kylinos.cn>
On 3/17/26 16:08, Werner Kasselman wrote:
> @@ -7685,6 +7691,19 @@ int smb2_lock(struct ksmbd_work *work)
> struct file_lock *rlock = NULL;
>
> rlock = smb_flock_init(filp);
> + if (!rlock) {
> + pr_err("rollback unlock alloc failed\n");
> + list_del(&smb_lock->llist);
> + spin_lock(&work->conn->llist_lock);
> + if (!list_empty(&smb_lock->flist))
> + list_del(&smb_lock->flist);
> + list_del(&smb_lock->clist);
> + spin_unlock(&work->conn->llist_lock);
> +
> + locks_free_lock(smb_lock->fl);
> + kfree(smb_lock);
> + continue;
> + }
> rlock->c.flc_type = F_UNLCK;
> rlock->fl_start = smb_lock->start;
> rlock->fl_end = smb_lock->end;
next prev parent reply other threads:[~2026-03-17 9:30 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-17 8:08 Werner Kasselman
2026-03-17 9:01 ` ChenXiaoSong
2026-03-17 9:29 ` ChenXiaoSong [this message]
2026-03-17 9:49 ` Werner Kasselman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9192ff4b-770a-411b-af5d-ab06d20248f8@chenxiaosong.com \
--to=chenxiaosong@chenxiaosong.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=senozhatsky@chromium.org \
--cc=smfrench@gmail.com \
--cc=stable@vger.kernel.org \
--cc=tom@talpey.com \
--cc=werner@verivus.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®