From: Shyam Prasad N <nspmangalore@gmail.com>
To: Steve French <smfrench@gmail.com>
Cc: Paulo Alcantara <pc@manguebit.org>,
Edward Adam Davis <eadavis@qq.com>,
syzbot+72afd4c236e6bc3f4bac@syzkaller.appspotmail.com,
linux-cifs@vger.kernel.org, sprasad@microsoft.com,
syzkaller-bugs@googlegroups.com,
samba-technical@lists.samba.org, linux-kernel@vger.kernel.org,
sfrench@samba.org, bharathsm@microsoft.com, tom@talpey.com
Subject: Re: [PATCH] cifs: client: fix memory leak in smb3_fs_context_parse_param
Date: Sat, 8 Nov 2025 09:58:46 +0530 [thread overview]
Message-ID: <CANT5p=pC2JShLzXPJG5imWTJBRfXheZeqBhMSpXuOw3rBkRxEw@mail.gmail.com> (raw)
In-Reply-To: <CAH2r5mvRrFmZFtNaQuRFHy2mVM1AG1AnsNwZMOoT=w8LZaLX4Q@mail.gmail.com>
On Sat, Nov 8, 2025 at 4:52 AM Steve French <smfrench@gmail.com> wrote:
>
> merged into cifs-2.6.git for-next pending additional testing.
>
> Also added Cc:stable tag
>
> On Fri, Nov 7, 2025 at 8:52 AM Paulo Alcantara via samba-technical
> <samba-technical@lists.samba.org> wrote:
> >
> > Edward Adam Davis <eadavis@qq.com> writes:
> >
> > > The user calls fsconfig twice, but when the program exits, free() only
> > > frees ctx->source for the second fsconfig, not the first.
> > > Regarding fc->source, there is no code in the fs context related to its
> > > memory reclamation.
> > >
> > > To fix this memory leak, release the source memory corresponding to ctx
> > > or fc before each parsing.
> > >
> > > syzbot reported:
> > > BUG: memory leak
> > > unreferenced object 0xffff888128afa360 (size 96):
> > > backtrace (crc 79c9c7ba):
> > > kstrdup+0x3c/0x80 mm/util.c:84
> > > smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444
> > >
> > > BUG: memory leak
> > > unreferenced object 0xffff888112c7d900 (size 96):
> > > backtrace (crc 79c9c7ba):
> > > smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629
> > > smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438
> > >
> > > Reported-by: syzbot+72afd4c236e6bc3f4bac@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > > ---
> > > fs/smb/client/fs_context.c | 2 ++
> > > 1 file changed, 2 insertions(+)
> >
> > Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
> >
>
>
> --
> Thanks,
>
> Steve
>
Looks good to me.
Steve, this is one of the mount options that is missing in the man page.
Also, I don't understand this option. Why is it needed? Don't we
specify the source in the mount command as devname anyway?
--
Regards,
Shyam
prev parent reply other threads:[~2025-11-08 4:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-07 7:30 [syzbot] [cifs?] memory leak in smb3_fs_context_parse_param syzbot
2025-11-07 14:01 ` [PATCH] cifs: client: fix " Edward Adam Davis
2025-11-07 14:30 ` Paulo Alcantara
2025-11-07 23:22 ` Steve French
2025-11-08 4:28 ` Shyam Prasad N [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CANT5p=pC2JShLzXPJG5imWTJBRfXheZeqBhMSpXuOw3rBkRxEw@mail.gmail.com' \
--to=nspmangalore@gmail.com \
--cc=bharathsm@microsoft.com \
--cc=eadavis@qq.com \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pc@manguebit.org \
--cc=samba-technical@lists.samba.org \
--cc=sfrench@samba.org \
--cc=smfrench@gmail.com \
--cc=sprasad@microsoft.com \
--cc=syzbot+72afd4c236e6bc3f4bac@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).