diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-05-26 13:57:38 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-06-02 13:37:06 +0000 |
| commit | 138c9932888f5d0f331a675ec1fa925fcb707976 (patch) | |
| tree | fb76b7b003f03f7f74b43d2643b651aca6c106a3 | |
| parent | ce8cbeaf39afbc696b1936127fabea45681c0348 (diff) | |
netsmb: Avoid a read-after-free in smb_t2_request_int()
Defer freeing the request structure until we've decided whether the
request should be retried.
PR: 255881
MFC after: 1 week
(cherry picked from commit 771e95d2e2ee1b60539f1273c62837b48249590a)
| -rw-r--r-- | sys/netsmb/smb_rq.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netsmb/smb_rq.c b/sys/netsmb/smb_rq.c index 544bfd1194f0..5a2ec0e7214a 100644 --- a/sys/netsmb/smb_rq.c +++ b/sys/netsmb/smb_rq.c @@ -738,13 +738,13 @@ smb_t2_request_int(struct smb_t2rq *t2p) bad: smb_iod_removerq(rqp); freerq: - smb_rq_done(rqp); if (error) { if (rqp->sr_flags & SMBR_RESTART) t2p->t2_flags |= SMBT2_RESTART; md_done(&t2p->t2_rparam); md_done(&t2p->t2_rdata); } + smb_rq_done(rqp); return error; } |