[lkml]   [2005]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH] fix use after free in smbfs.
    From code inspection it seems that after freeing 'req', in smb_request()
    we continue to dereference it a dozen or so times.

    That whole area of code looks suspect.
    if (!(req->rq_flags & SMB_REQ_RECEIVED)) {

    smb_rput() also does a list_del_init, but only if its safe
    to do so (ie, the refcount has dropped to 0).
    To my not-smbfs-savvy eyes, it would seem that we could
    potentially nuke the ->rq_queue list, and return from
    smb_rput() if the request was still in use. What the rest
    of the code does with such a buggered-up request, I've no
    idea, but it probably isn't pretty.

    Perhaps smb_rput should be taking a pointer to a request that can
    be null'd on success ?

    Signed-off-by: Dave Jones <>

    --- linux-2.6.12/fs/smbfs/request.c~ 2005-07-07 14:41:11.000000000 -0400
    +++ linux-2.6.12/fs/smbfs/request.c 2005-07-07 14:41:22.000000000 -0400
    @@ -348,6 +348,7 @@ int smb_add_request(struct smb_request *
    + return -EINTR;

    if (!timeleft) {

    Looking further, we do exactly the same thing in smb_request_recv()

    ditto in smbiod.c..

    What am I missing here? smb_rput() -> smb_free_request() does
    a kmem_cache_free(req_cachep, req); making further use of that
    cache item invalid.


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-07-07 21:07    [W:0.025 / U:12.496 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site