Re: [PATCH] smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

On Wed, Jul 8, 2026 at 5:33 AM Enzo Matsumiya <[email protected]> wrote:
>
> Free it in ksmbd_alloc_user() (the only function that uses it).
>
> kmemleak splat:
>   unreferenced object 0xffff888103b83540 (size 192):
>     comm "pool-0", pid 16970, jiffies 4377290937
>     hex dump (first 32 bytes):
>       00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
>       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     backtrace (crc 408ccc66):
>       __kvmalloc_node_noprof+0x730/0x920
>       handle_generic_event+0xec/0x1a0 [ksmbd]
>       genl_family_rcv_msg_doit+0xe0/0x130
>       genl_rcv_msg+0x181/0x290
>       netlink_rcv_skb+0x4f/0x100
>       genl_rcv+0x28/0x40
>       netlink_unicast+0x1e6/0x2c0
>       netlink_sendmsg+0x20a/0x450
>       ____sys_sendmsg+0x2e8/0x310
>       ___sys_sendmsg+0x78/0xc0
>       __sys_sendmsg+0x63/0xc0
>       do_syscall_64+0xa1/0x670
>       entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> Fixes: a77e0e02af1c ("ksmbd: add support for supplementary groups")
> Signed-off-by: Enzo Matsumiya <[email protected]>
> ---
>  fs/smb/server/mgmt/user_config.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/fs/smb/server/mgmt/user_config.c b/fs/smb/server/mgmt/user_config.c
> index cf45841d9d1b..2319c6cc67da 100644
> --- a/fs/smb/server/mgmt/user_config.c
> +++ b/fs/smb/server/mgmt/user_config.c
> @@ -66,12 +66,14 @@ struct ksmbd_user *ksmbd_alloc_user(struct ksmbd_login_response *resp,
>                 ksmbd_debug(SMB, "supplementary groups : %d\n", user->ngroups);
>         }
>
> +       kfree(resp_ext);
>         return user;
>
>  err_free:
>         kfree(user->name);
>         kfree(user->passkey);
>         kfree(user);
> +       kfree(resp_ext);
>         return NULL;
>  }
Please use kvfree() and free it from the caller.

diff --git a/fs/smb/server/mgmt/user_config.c b/fs/smb/server/mgmt/user_config.c
index cf45841d9d1b..03184a3303b9 100644
--- a/fs/smb/server/mgmt/user_config.c
+++ b/fs/smb/server/mgmt/user_config.c
@@ -26,6 +26,7 @@ struct ksmbd_user *ksmbd_login_user(const char *account)
                resp_ext = ksmbd_ipc_login_request_ext(account);

        user = ksmbd_alloc_user(resp, resp_ext);
+       kvfree(resp_ext);
 out:
        kvfree(resp);
        return user;
>
> --
> 2.54.0
>