diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2025-05-22 12:35:16 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2025-05-22 12:35:16 -0700 |
| commit | e85dea591fbf900330c796579314bfb7cc399d31 (patch) | |
| tree | c0d321748d2fec2e3b9a3672ec99d3b15a2409ed | |
| parent | 5cdb2c77c4c3d36bdee83d9231649941157f8204 (diff) | |
| parent | e48f9d849bfdec276eebf782a84fd4dfbe1c14c0 (diff) | |
Merge tag '6.15-rc8-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- Two fixes for use after free in readdir code paths
* tag '6.15-rc8-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
smb: client: Reset all search buffer pointers when releasing buffer
smb: client: Fix use-after-free in cifs_fill_dirent
| -rw-r--r-- | fs/smb/client/readdir.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c index 50f96259d9adc..787d6bcb5d1dc 100644 --- a/fs/smb/client/readdir.c +++ b/fs/smb/client/readdir.c @@ -733,7 +733,10 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, else cifs_buf_release(cfile->srch_inf. ntwrk_buf_start); + /* Reset all pointers to the network buffer to prevent stale references */ cfile->srch_inf.ntwrk_buf_start = NULL; + cfile->srch_inf.srch_entries_start = NULL; + cfile->srch_inf.last_entry = NULL; } rc = initiate_cifs_search(xid, file, full_path); if (rc) { @@ -756,11 +759,11 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, rc = server->ops->query_dir_next(xid, tcon, &cfile->fid, search_flags, &cfile->srch_inf); + if (rc) + return -ENOENT; /* FindFirst/Next set last_entry to NULL on malformed reply */ if (cfile->srch_inf.last_entry) cifs_save_resume_key(cfile->srch_inf.last_entry, cfile); - if (rc) - return -ENOENT; } if (index_to_find < cfile->srch_inf.index_of_last_entry) { /* we found the buffer that contains the entry */ |