d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netsmb: Avoid a read-after-free in smb_t2_request_int()

Browse Source 
Defer freeing the request structure until we've decided whether the
request should be retried.

PR:		255881
MFC after:	1 week
This commit is contained in:
Mark Johnston 2021-05-26 09:57:38 -04:00
parent 71776d6719
commit 771e95d2e2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/netsmb/smb_rq.c
View File

@ -737,13 +737,13 @@ smb_t2_request_int(struct smb_t2rq *t2p)
bad: bad:
smb_iod_removerq(rqp); smb_iod_removerq(rqp);
freerq: freerq:
smb_rq_done(rqp);
if (error) { if (error) {
if (rqp->sr_flags & SMBR_RESTART) if (rqp->sr_flags & SMBR_RESTART)
t2p->t2_flags |= SMBT2_RESTART; t2p->t2_flags |= SMBT2_RESTART;
md_done(&t2p->t2_rparam); md_done(&t2p->t2_rparam);
md_done(&t2p->t2_rdata); md_done(&t2p->t2_rdata);
} }
smb_rq_done(rqp);
return error; return error;
} }