ksmbd: fix use-after-free in smb2_lock

If smb_lock->zero_len has value, ->llist of smb_lock is not delete and
flock is old one. It will cause use-after-free on error handling
routine.

Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index f1efcd0274750fc7c97c79bfc032bca8e35a7383..35bed8fc1b97019a910993eb3dc63869e7a37f9a 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7458,13 +7458,13 @@ out_check_cl:
                }
 
 no_check_cl:
+               flock = smb_lock->fl;
+               list_del(&smb_lock->llist);
+
                if (smb_lock->zero_len) {
                        err = 0;
                        goto skip;
                }
-
-               flock = smb_lock->fl;
-               list_del(&smb_lock->llist);
 retry:
                rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL);
 skip: