Re: [PATCH] ksmbd: fix memory leaks and NULL deref in smb2_lock()

[ChenXiaoSong]

And it might be better to change it as follows.

```
@@ -7685,13 +7686,17 @@ int smb2_lock(struct ksmbd_work *work)
                struct file_lock *rlock = NULL;

                rlock = smb_flock_init(filp);
-               rlock->c.flc_type = F_UNLCK;
-               rlock->fl_start = smb_lock->start;
-               rlock->fl_end = smb_lock->end;
+               if (rlock) {
+                       rlock->c.flc_type = F_UNLCK;
+                       rlock->fl_start = smb_lock->start;
+                       rlock->fl_end = smb_lock->end;

-               rc = vfs_lock_file(filp, F_SETLK, rlock, NULL);
-               if (rc)
-                       pr_err("rollback unlock fail : %d\n", rc);
+                       rc = vfs_lock_file(filp, F_SETLK, rlock, NULL);
+                       if (rc)
+                               pr_err("rollback unlock fail : %d\n", rc);
+               } else {
+                       pr_err("rollback unlock alloc failed\n");
+               }

                list_del(&smb_lock->llist);
                spin_lock(&work->conn->llist_lock);
@@ -7701,7 +7706,8 @@ int smb2_lock(struct ksmbd_work *work)
                spin_unlock(&work->conn->llist_lock);

                locks_free_lock(smb_lock->fl);
-               locks_free_lock(rlock);
+               if (rlock)
+                       locks_free_lock(rlock);
                kfree(smb_lock);
        }
 out2:
```

Thanks,
ChenXiaoSong <chenxiaosong@xxxxxxxxxx>

On 3/17/26 16:08, Werner Kasselman wrote:
> @@ -7685,6 +7691,19 @@ int smb2_lock(struct ksmbd_work *work)
>   		struct file_lock *rlock = NULL;
>   
>   		rlock = smb_flock_init(filp);
> +		if (!rlock) {
> +			pr_err("rollback unlock alloc failed\n");
> +			list_del(&smb_lock->llist);
> +			spin_lock(&work->conn->llist_lock);
> +			if (!list_empty(&smb_lock->flist))
> +				list_del(&smb_lock->flist);
> +			list_del(&smb_lock->clist);
> +			spin_unlock(&work->conn->llist_lock);
> +
> +			locks_free_lock(smb_lock->fl);
> +			kfree(smb_lock);
> +			continue;
> +		}
>   		rlock->c.flc_type = F_UNLCK;
>   		rlock->fl_start = smb_lock->start;
>   		rlock->fl_end = smb_lock->end;