[PATCH] cifs: client: fix memory leak in smb3_fs_context_parse_param

[Steve French]

merged into cifs-2.6.git for-next pending additional testing.

Also added Cc:stable tag

On Fri, Nov 7, 2025 at 8:52 AM Paulo Alcantara via samba-technical
<samba-technical at lists.samba.org> wrote:
>
> Edward Adam Davis <eadavis at qq.com> writes:
>
> > The user calls fsconfig twice, but when the program exits, free() only
> > frees ctx->source for the second fsconfig, not the first.
> > Regarding fc->source, there is no code in the fs context related to its
> > memory reclamation.
> >
> > To fix this memory leak, release the source memory corresponding to ctx
> > or fc before each parsing.
> >
> > syzbot reported:
> > BUG: memory leak
> > unreferenced object 0xffff888128afa360 (size 96):
> >   backtrace (crc 79c9c7ba):
> >     kstrdup+0x3c/0x80 mm/util.c:84
> >     smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444
> >
> > BUG: memory leak
> > unreferenced object 0xffff888112c7d900 (size 96):
> >   backtrace (crc 79c9c7ba):
> >     smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629
> >     smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438
> >
> > Reported-by: syzbot+72afd4c236e6bc3f4bac at syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac
> > Signed-off-by: Edward Adam Davis <eadavis at qq.com>
> > ---
> >  fs/smb/client/fs_context.c | 2 ++
> >  1 file changed, 2 insertions(+)
>
> Reviewed-by: Paulo Alcantara (Red Hat) <pc at manguebit.org>
>


-- 
Thanks,

Steve