[Bug 295577] smbfs: smbfs_node_alloc() leaks name buffers when insmntque() fails

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295577

--- Comment #3 from Haoxiang Li <[email protected]> ---
Comment on attachment 271190
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=271190
Commit candidate

>From 7781f0278a29a31753e2f9795af40c598362e974 Mon Sep 17 00:00:00 2001
>From: Haoxiang Li <[email protected]>
>Date: Tue, 26 May 2026 16:21:39 +0300
>Subject: [PATCH] smbfs: plug smbfs_node_alloc() leak of name buffers when
> insmntque() fails
>
>PR:	295577
>MFC after:	2 weeks
>---
> sys/fs/smbfs/smbfs_node.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/sys/fs/smbfs/smbfs_node.c b/sys/fs/smbfs/smbfs_node.c
>index 9893987f7ccd..b2b5d63e2eaf 100644
>--- a/sys/fs/smbfs/smbfs_node.c
>+++ b/sys/fs/smbfs/smbfs_node.c
>@@ -212,6 +212,10 @@ smbfs_node_alloc(struct mount *mp, struct vnode *dvp, const char *dirnm,
> 		SMBERROR("new vnode '%s' born without parent ?\n", np->n_name);
> 	error = insmntque(vp, mp);
> 	if (error) {
>+		smbfs_name_free(np->n_name);
>+		free(np->n_rpath, M_SMBNODENAME);
>+		if (np->n_parent != NULL && (np->n_flag & NREFPARENT) != 0)
>+			vrele(np->n_parent);
> 		free(np, M_SMBNODE);
> 		return (error);
> 	}
>-- 
>2.54.0
>

-- 
You are receiving this mail because:
You are the assignee for the bug.