diff options
| author | Yichong Chen <chenyichong@uniontech.com> | 2026-07-04 13:27:14 +0800 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2026-07-27 17:25:58 -0500 |
| commit | 9388e7c820e33d3a7dfde9a9c16ad4ac60f29d37 (patch) | |
| tree | 6fe41e8d3d18bd0d9a88b6fecc203bcdf5e66d56 /fs/smb | |
| parent | 455488cd5054bcc59db40fa1cc2c004031a5b2a5 (diff) | |
| download | linux-next-9388e7c820e33d3a7dfde9a9c16ad4ac60f29d37.tar.gz linux-next-9388e7c820e33d3a7dfde9a9c16ad4ac60f29d37.zip | |
smb: client: free partially allocated transform folio queue
netfs_alloc_folioq_buffer() may leave a partially allocated folio
queue attached to the caller's buffer pointer when it returns an error.
smb3_init_transform_rq() stores the buffer in the request only after
allocation succeeds, so the common error path cannot free a partial
allocation. Store the buffer pointer before checking the return value so
err_free releases it.
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb')
| -rw-r--r-- | fs/smb/client/smb2ops.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index cbd51a08e97e..192649fec25d 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4745,10 +4745,10 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst, size_t cur_size = 0; rc = netfs_alloc_folioq_buffer(NULL, &buffer, &cur_size, size, GFP_NOFS); + new->rq_buffer = buffer; if (rc < 0) goto err_free; - new->rq_buffer = buffer; iov_iter_folio_queue(&new->rq_iter, ITER_SOURCE, buffer, 0, 0, size); |