diff mbox series

[5.10,023/152] cifs: check pointer before freeing

Message ID	20210118113353.889449311@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Tom Rix <trix@redhat.com>, Nathan Chancellor <natechancellor@gmail.com>, Steve French <stfrench@microsoft.com> Subject: [PATCH 5.10 023/152] cifs: check pointer before freeing Date: Mon, 18 Jan 2021 12:33:18 +0100 Message-Id: <20210118113353.889449311@linuxfoundation.org> In-Reply-To: <20210118113352.764293297@linuxfoundation.org> References: <20210118113352.764293297@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/152] btrfs: prevent NULL pointer dereference in extent_io_tree_panic [5.10,003/152] ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines [5.10,004/152] ALSA: doc: Fix reference to mixart.rst [5.10,005/152] ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395 [5.10,006/152] ASoC: dapm: remove widget from dirty list on free [5.10,007/152] x86/hyperv: check cpu mask after interrupt has been disabled [5.10,008/152] drm/amdgpu: add green_sardine device id (v2) [5.10,009/152] drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug 210921) [5.10,010/152] Revert "drm/amd/display: Fixed Intermittent blue screen on OLED panel" [5.10,011/152] drm/amdgpu: add new device id for Renior [5.10,012/152] drm/i915: Allow the sysadmin to override security mitigations [5.10,013/152] drm/i915/gt: Limit VFE threads based on GT [5.10,014/152] drm/i915/backlight: fix CPU mode backlight takeover on LPT [5.10,015/152] drm/bridge: sii902x: Refactor init code into separate function [5.10,016/152] dt-bindings: display: sii902x: Add supply bindings [5.10,017/152] drm/bridge: sii902x: Enable I/O and core VCC supplies if present [5.10,018/152] tracing/kprobes: Do the notrace functions check without kprobes on ftrace [5.10,019/152] tools/bootconfig: Add tracing_on support to helper scripts [5.10,020/152] ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when IS_ERR [5.10,021/152] ext4: fix wrong list_splice in ext4_fc_cleanup [5.10,022/152] ext4: fix bug for rename with RENAME_WHITEOUT [5.10,023/152] cifs: check pointer before freeing [5.10,024/152] cifs: fix interrupted close commands [5.10,025/152] riscv: Drop a duplicated PAGE_KERNEL_EXEC [5.10,026/152] riscv: return -ENOSYS for syscall -1 [5.10,027/152] riscv: Fixup CONFIG_GENERIC_TIME_VSYSCALL [5.10,028/152] riscv: Fix KASAN memory mapping. [5.10,029/152] mips: fix Section mismatch in reference [5.10,030/152] mips: lib: uncached: fix non-standard usage of variable sp [5.10,031/152] MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB [5.10,032/152] MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps [5.10,033/152] MIPS: relocatable: fix possible boot hangup with KASLR enabled [5.10,034/152] RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() [5.10,035/152] ACPI: scan: Harden acpi_device_add() against device ID overflows [5.10,036/152] xen/privcmd: allow fetching resource sizes [5.10,037/152] compiler.h: Raise minimum version of GCC to 5.1 for arm64 [5.10,038/152] mm/vmalloc.c: fix potential memory leak [5.10,039/152] mm/hugetlb: fix potential missing huge page size info [5.10,040/152] mm/process_vm_access.c: include compat.h [5.10,041/152] dm raid: fix discard limits for raid1 [5.10,042/152] dm snapshot: flush merged data before committing metadata [5.10,043/152] dm integrity: fix flush with external metadata device [5.10,044/152] dm integrity: fix the maximum number of arguments [5.10,045/152] dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq [5.10,046/152] dm crypt: do not wait for backlogged crypto request completion in softirq [5.10,047/152] dm crypt: do not call bio_endio() from the dm-crypt tasklet [5.10,048/152] dm crypt: defer decryption to a tasklet if interrupts disabled [5.10,049/152] stmmac: intel: change all EHL/TGL to auto detect phy addr [5.10,050/152] r8152: Add Lenovo Powered USB-C Travel Hub [5.10,051/152] btrfs: tree-checker: check if chunk item end overflows [5.10,052/152] ext4: dont leak old mountpoint samples [5.10,053/152] io_uring: dont take files/mm for a dead task [5.10,054/152] io_uring: drop mm and files after task_work_run [5.10,055/152] ARC: build: remove non-existing bootpImage from KBUILD_IMAGE [5.10,056/152] ARC: build: add uImage.lzma to the top-level target [5.10,057/152] ARC: build: add boot_targets to PHONY [5.10,058/152] ARC: build: move symlink creation to arch/arc/Makefile to avoid race [5.10,059/152] ARM: omap2: pmic-cpcap: fix maximum voltage to be consistent with defaults on xt875 [5.10,060/152] ath11k: fix crash caused by NULL rx_channel [5.10,061/152] netfilter: ipset: fixes possible oops in mtype_resize [5.10,062/152] ath11k: qmi: try to allocate a big block of DMA memory first [5.10,063/152] btrfs: fix async discard stall [5.10,064/152] btrfs: merge critical sections of discard lock in workfn [5.10,065/152] btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan [5.10,066/152] regulator: bd718x7: Add enable times [5.10,067/152] ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram [5.10,068/152] ARM: dts: ux500/golden: Set display max brightness [5.10,069/152] habanalabs: adjust pci controller init to new firmware [5.10,070/152] habanalabs/gaudi: retry loading TPC f/w on -EINTR [5.10,071/152] habanalabs: register to pci shutdown callback [5.10,072/152] staging: spmi: hisi-spmi-controller: Fix some error handling paths [5.10,073/152] spi: altera: fix return value for altera_spi_txrx() [5.10,074/152] habanalabs: Fix memleak in hl_device_reset [5.10,075/152] hwmon: (pwm-fan) Ensure that calculation doesnt discard big period values [5.10,076/152] lib/raid6: Let $(UNROLL) rules work with macOS userland [5.10,077/152] kconfig: remove kvmconfig and xenconfig shorthands [5.10,078/152] spi: fix the divide by 0 error when calculating xfer waiting time [5.10,079/152] io_uring: drop file refs after task cancel [5.10,080/152] bfq: Fix computation of shallow depth [5.10,081/152] arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC [5.10,082/152] misdn: dsp: select CONFIG_BITREVERSE [5.10,083/152] net: ethernet: fs_enet: Add missing MODULE_LICENSE [5.10,084/152] selftests: fix the return value for UDP GRO test [5.10,085/152] nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN [5.10,086/152] nvme: avoid possible double fetch in handling CQE [5.10,087/152] nvmet-rdma: Fix list_del corruption on queue establishment failure [5.10,088/152] drm/amd/display: fix sysfs amdgpu_current_backlight_pwm NULL pointer issue [5.10,089/152] drm/amdgpu: fix a GPU hang issue when remove device [5.10,090/152] drm/amd/pm: fix the failure when change power profile for renoir [5.10,091/152] drm/amdgpu: fix potential memory leak during navi12 deinitialization [5.10,092/152] usb: typec: Fix copy paste error for NVIDIA alt-mode description [5.10,093/152] iommu/vt-d: Fix lockdep splat in sva bind()/unbind() [5.10,094/152] ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI [5.10,095/152] drm/msm: Call msm_init_vram before binding the gpu [5.10,096/152] ARM: picoxcell: fix missing interrupt-parent properties [5.10,097/152] poll: fix performance regression due to out-of-line __put_user() [5.10,098/152] rcu-tasks: Move RCU-tasks initialization to before early_initcall() [5.10,099/152] bpf: Simplify task_file_seq_get_next() [5.10,100/152] bpf: Save correct stopping point in file seq iteration [5.10,101/152] x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling [5.10,102/152] cfg80211: select CONFIG_CRC32 [5.10,103/152] nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context [5.10,104/152] iommu/vt-d: Update domain geometry in iommu_ops.at(de)tach_dev [5.10,105/152] net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled [5.10,106/152] net/mlx5: Fix passing zero to PTR_ERR [5.10,107/152] net/mlx5: E-Switch, fix changing vf VLANID [5.10,108/152] blk-mq-debugfs: Add decode for BLK_MQ_F_TAG_HCTX_SHARED [5.10,109/152] mm: fix clear_refs_write locking [5.10,110/152] mm: dont play games with pinned pages in clear_page_refs [5.10,111/152] mm: dont put pinned pages into the swap cache [5.10,112/152] perf intel-pt: Fix CPU too large error [5.10,113/152] dump_common_audit_data(): fix racy accesses to ->d_name [5.10,114/152] ASoC: meson: axg-tdm-interface: fix loopback [5.10,115/152] ASoC: meson: axg-tdmin: fix axg skew offset [5.10,116/152] ASoC: Intel: fix error code cnl_set_dsp_D0() [5.10,117/152] nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY [5.10,118/152] nvme: dont intialize hwmon for discovery controllers [5.10,119/152] nvme-tcp: fix possible data corruption with bio merges [5.10,120/152] nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT [5.10,121/152] NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock [5.10,122/152] pNFS: We want return-on-close to complete when evicting the inode [5.10,123/152] pNFS: Mark layout for return if return-on-close was not sent [5.10,124/152] pNFS: Stricter ordering of layoutget and layoutreturn [5.10,125/152] NFS: Adjust fs_context error logging [5.10,126/152] NFS/pNFS: Dont call pnfs_free_bucket_lseg() before removing the request [5.10,127/152] NFS/pNFS: Dont leak DS commits in pnfs_generic_retry_commit() [5.10,128/152] NFS/pNFS: Fix a leak of the layout plh_outstanding counter [5.10,129/152] NFS: nfs_delegation_find_inode_server must first reference the superblock [5.10,130/152] NFS: nfs_igrab_and_active must first reference the superblock [5.10,131/152] scsi: ufs: Fix possible power drain during system suspend [5.10,132/152] ext4: fix superblock checksum failure when setting password salt [5.10,133/152] RDMA/restrack: Dont treat as an error allocation ID wrapping [5.10,134/152] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp [5.10,135/152] bnxt_en: Improve stats context resource accounting with RDMA driver loaded. [5.10,136/152] RDMA/mlx5: Fix wrong free of blue flame register on error [5.10,137/152] IB/mlx5: Fix error unwinding when set_has_smi_cap fails [5.10,138/152] umount(2): move the flag validity checks first [5.10,139/152] dm zoned: select CONFIG_CRC32 [5.10,140/152] drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no res... [5.10,141/152] drm/i915/icl: Fix initing the DSI DSC power refcount during HW readout [5.10,142/152] drm/i915/gt: Restore clear-residual mitigations for Ivybridge, Baytrail [5.10,143/152] mm, slub: consider rest of partial list if acquire_slab() fails [5.10,144/152] riscv: Trace irq on only interrupt is enabled [5.10,145/152] iommu/vt-d: Fix unaligned addresses for intel_flush_svm_range_dev() [5.10,146/152] net: sunrpc: interpret the return value of kstrtou32 correctly [5.10,147/152] selftests: netfilter: Pass family parameter "-f" to conntrack tool [5.10,148/152] dm: eliminate potential source of excessive kernel log noise [5.10,149/152] ALSA: fireface: Fix integer overflow in transmit_midi_msg() [5.10,150/152] ALSA: firewire-tascam: Fix integer overflow in midi_port_work() [5.10,151/152] netfilter: conntrack: fix reading nf_conntrack_buckets [5.10,152/152] netfilter: nf_nat: Fix memleak in nf_nat_init

Commit Message

Greg Kroah-Hartman Jan. 18, 2021, 11:33 a.m. UTC

From: Tom Rix <trix@redhat.com>

commit 77b6ec01c29aade01701aa30bf1469acc7f2be76 upstream.

clang static analysis reports this problem

dfs_cache.c:591:2: warning: Argument to kfree() is a constant address
  (18446744073709551614), which is not memory allocated by malloc()
        kfree(vi);
        ^~~~~~~~~

In dfs_cache_del_vol() the volume info pointer 'vi' being freed
is the return of a call to find_vol().  The large constant address
is find_vol() returning an error.

Add an error check to dfs_cache_del_vol() similar to the one done
in dfs_cache_update_vol().

Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
CC: <stable@vger.kernel.org> # v5.0+
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/dfs_cache.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

--- a/fs/cifs/dfs_cache.c
+++ b/fs/cifs/dfs_cache.c
@@ -1317,7 +1317,8 @@  void dfs_cache_del_vol(const char *fullp
 	vi = find_vol(fullpath);
 	spin_unlock(&vol_list_lock);
 
-	kref_put(&vi->refcnt, vol_release);
+	if (!IS_ERR(vi))
+		kref_put(&vi->refcnt, vol_release);
 }
 
 /**