Merge tag '6.2-rc8-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6

torvalds · torvalds · commit 94a1f56db688 · 2023-02-09T09:00:26.000-08:00
Pull cifx fix from Steve French:
 "Small fix for use after free"

* tag '6.2-rc8-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Fix use-after-free in rdata-&gt;read_into_pages()
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
@@ -3889,7 +3889,7 @@ uncached_fill_pages(struct TCP_Server_Info *server,
 		rdata->got_bytes += result;
 	}
 
-	return rdata->got_bytes > 0 && result != -ECONNABORTED ?
+	return result != -ECONNABORTED && rdata->got_bytes > 0 ?
 						rdata->got_bytes : result;
 }
 
@@ -4665,7 +4665,7 @@ readpages_fill_pages(struct TCP_Server_Info *server,
 		rdata->got_bytes += result;
 	}
 
-	return rdata->got_bytes > 0 && result != -ECONNABORTED ?
+	return result != -ECONNABORTED && rdata->got_bytes > 0 ?
 						rdata->got_bytes : result;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -3889,7 +3889,7 @@ uncached_fill_pages(struct TCP_Server_Info *server,`
`3889`	`3889`	`rdata->got_bytes += result;`
`3890`	`3890`	`}`
`3891`	`3891`
`3892`		`- return rdata->got_bytes > 0 && result != -ECONNABORTED ?`
	`3892`	`+ return result != -ECONNABORTED && rdata->got_bytes > 0 ?`
`3893`	`3893`	`rdata->got_bytes : result;`
`3894`	`3894`	`}`
`3895`	`3895`
`@@ -4665,7 +4665,7 @@ readpages_fill_pages(struct TCP_Server_Info *server,`
`4665`	`4665`	`rdata->got_bytes += result;`
`4666`	`4666`	`}`
`4667`	`4667`
`4668`		`- return rdata->got_bytes > 0 && result != -ECONNABORTED ?`
	`4668`	`+ return result != -ECONNABORTED && rdata->got_bytes > 0 ?`
`4669`	`4669`	`rdata->got_bytes : result;`
`4670`	`4670`	`}`
`4671`	`4671`