Commit 663a9621 authored by Pavel Shilovsky's avatar Pavel Shilovsky Committed by Steve French

CIFS: Fix memory leaks in SMB2_open

Cc: <stable@vger.kernel.org> # v3.12+
Signed-off-by: default avatarPavel Shilovsky <pshilovsky@samba.org>
Reviewed-by: default avatarShirish Pargaonkar <spargaonkar@suse.com>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent 08b37d51
...@@ -1097,6 +1097,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, ...@@ -1097,6 +1097,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
int rc = 0; int rc = 0;
unsigned int num_iovecs = 2; unsigned int num_iovecs = 2;
__u32 file_attributes = 0; __u32 file_attributes = 0;
char *dhc_buf = NULL, *lc_buf = NULL;
cifs_dbg(FYI, "create/open\n"); cifs_dbg(FYI, "create/open\n");
...@@ -1163,6 +1164,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, ...@@ -1163,6 +1164,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
kfree(copy_path); kfree(copy_path);
return rc; return rc;
} }
lc_buf = iov[num_iovecs-1].iov_base;
} }
if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) {
...@@ -1177,9 +1179,10 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, ...@@ -1177,9 +1179,10 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
if (rc) { if (rc) {
cifs_small_buf_release(req); cifs_small_buf_release(req);
kfree(copy_path); kfree(copy_path);
kfree(iov[num_iovecs-1].iov_base); kfree(lc_buf);
return rc; return rc;
} }
dhc_buf = iov[num_iovecs-1].iov_base;
} }
rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0); rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
...@@ -1211,6 +1214,8 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, ...@@ -1211,6 +1214,8 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
*oplock = rsp->OplockLevel; *oplock = rsp->OplockLevel;
creat_exit: creat_exit:
kfree(copy_path); kfree(copy_path);
kfree(lc_buf);
kfree(dhc_buf);
free_rsp_buf(resp_buftype, rsp); free_rsp_buf(resp_buftype, rsp);
return rc; return rc;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment