smb: client: Reset all search buffer pointers when releasing buffer
authorWang Zhaolong <wangzhaolong1@huawei.com>
Fri, 16 May 2025 09:12:56 +0000 (17:12 +0800)
committerSteve French <stfrench@microsoft.com>
Tue, 20 May 2025 01:29:06 +0000 (20:29 -0500)
commite48f9d849bfdec276eebf782a84fd4dfbe1c14c0
treeef8e46b1b3f3ac9f43bc4e6f2266fd0db1450b56
parenta7a8fe56e932a36f43e031b398aef92341bf5ea0
smb: client: Reset all search buffer pointers when releasing buffer

Multiple pointers in struct cifs_search_info (ntwrk_buf_start,
srch_entries_start, and last_entry) point to the same allocated buffer.
However, when freeing this buffer, only ntwrk_buf_start was set to NULL,
while the other pointers remained pointing to freed memory.

This is defensive programming to prevent potential issues with stale
pointers. While the active UAF vulnerability is fixed by the previous
patch, this change ensures consistent pointer state and more robust error
handling.

Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com>
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/readdir.c