Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge tag 'v5.2-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French:
"Four small smb3 fixes, one for stable"

* tag 'v5.2-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM
dfs_cache: fix a wrong use of kfree in flush_cache_ent()
fs/cifs/smb2pdu.c: fix buffer free in SMB2_ioctl_free
cifs: fix memory leak of pneg_inbuf on -EOPNOTSUPP ioctl case

+11 -6
+2 -2
fs/cifs/dfs_cache.c
··· 132 132 return; 133 133 134 134 hlist_del_init_rcu(&ce->ce_hlist); 135 - kfree(ce->ce_path); 135 + kfree_const(ce->ce_path); 136 136 free_tgts(ce); 137 137 dfs_cache_count--; 138 138 call_rcu(&ce->ce_rcu, free_cache_entry); ··· 422 422 423 423 rc = copy_ref_data(refs, numrefs, ce, NULL); 424 424 if (rc) { 425 - kfree(ce->ce_path); 425 + kfree_const(ce->ce_path); 426 426 kmem_cache_free(dfs_cache_slab, ce); 427 427 ce = ERR_PTR(rc); 428 428 }
+3 -1
fs/cifs/file.c
··· 3216 3216 } 3217 3217 3218 3218 if (rc) { 3219 - for (i = 0; i < nr_pages; i++) { 3219 + unsigned int nr_page_failed = i; 3220 + 3221 + for (i = 0; i < nr_page_failed; i++) { 3220 3222 put_page(rdata->pages[i]); 3221 3223 rdata->pages[i] = NULL; 3222 3224 }
+6 -3
fs/cifs/smb2pdu.c
··· 1054 1054 * not supported error. Client should accept it. 1055 1055 */ 1056 1056 cifs_dbg(VFS, "Server does not support validate negotiate\n"); 1057 - return 0; 1057 + rc = 0; 1058 + goto out_free_inbuf; 1058 1059 } else if (rc != 0) { 1059 1060 cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc); 1060 1061 rc = -EIO; ··· 2620 2619 void 2621 2620 SMB2_ioctl_free(struct smb_rqst *rqst) 2622 2621 { 2622 + int i; 2623 2623 if (rqst && rqst->rq_iov) { 2624 2624 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 2625 - if (rqst->rq_iov[1].iov_len) 2626 - kfree(rqst->rq_iov[1].iov_base); 2625 + for (i = 1; i < rqst->rq_nvec; i++) 2626 + if (rqst->rq_iov[i].iov_base != smb2_padding) 2627 + kfree(rqst->rq_iov[i].iov_base); 2627 2628 } 2628 2629 } 2629 2630