]> www.infradead.org Git - users/dwmw2/linux.git/commit
CIFS: fix use-after-free of the lease keys
authorAurelien Aptel <aaptel@suse.com>
Thu, 31 Jan 2019 12:46:07 +0000 (13:46 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 6 Feb 2019 16:27:40 +0000 (17:27 +0100)
commit2da24a1c475c9a284de4a7eac57bf3de7e34cbca
tree13cf66e30b7c44539c1c7756bccdc0511c7bfe15
parent50dd5c261f729f2b5714577cdaba50a75f9d7455
CIFS: fix use-after-free of the lease keys

commit d339adc12a4f885b572c5412e4869af8939db854 upstream.

The request buffers are freed right before copying the pointers.
Use the func args instead which are identical and still valid.

Simple reproducer (requires KASAN enabled) on a cifs mount:

echo foo > foo ; tail -f foo & rm foo

Cc: <stable@vger.kernel.org> # 4.20
Fixes: 179e44d49c2f ("smb3: add tracepoint for sending lease break responses to server")
Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/cifs/smb2pdu.c