smb: client: fix query_info() replay double-free
commit 2a88561d66eb855813cf004a0abe648bbb17de5e upstream.
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_info_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
BUG=b/539153414
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2026-64386 in the Linux kernel.
cos-patch: security-moderate
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Change-Id: I8ef69f9848a44e676e77abd6f29db6093557da3a
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kernel CVE Triage Automation <cloud-image-kernel-cve-triage-automation@prod.google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/173634
Reviewed-by: Dom Huh <domhuh@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Angel Adetula <angeladetula@google.com>
1 file changed
