From f13208f26c052d06a10c53eda4c78c930f2b9c47 Mon Sep 17 00:00:00 2001 From: Paulo Alcantara Date: Mon, 12 Oct 2026 01:52:46 -0300 Subject: smb: client: allocate struct sess_data on the stack CIFS_SessSetup() kzalloc()s struct sess_data only to run a synchronous state machine and free it before returning; the object never escapes the function. At 96 bytes it fits comfortably on the stack even under CONFIG_FRAME_WARN=1024, so drop the allocation and its failure path. memzero_explicit() preserves the kfree_sensitive() scrubbing. Signed-off-by: Paulo Alcantara Reviewed-by: David Howells Cc: Namjae Jeon Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Bharath SM --- fs/smb/client/smb1session.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/fs/smb/client/smb1session.c b/fs/smb/client/smb1session.c index c45d3254dfac..5f469b4d70f7 100644 --- a/fs/smb/client/smb1session.c +++ b/fs/smb/client/smb1session.c @@ -949,34 +949,31 @@ static int select_sec(struct sess_data *sess_data) int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses, struct TCP_Server_Info *server) { + struct sess_data sess_data; int rc = 0; - struct sess_data *sess_data; if (ses == NULL) { WARN(1, "%s: ses == NULL!", __func__); return -EINVAL; } - sess_data = kzalloc_obj(struct sess_data); - if (!sess_data) - return -ENOMEM; + sess_data = (struct sess_data) { + .xid = xid, + .ses = ses, + .server = server, + .buf0_type = CIFS_NO_BUFFER, + }; - sess_data->xid = xid; - sess_data->ses = ses; - sess_data->server = server; - sess_data->buf0_type = CIFS_NO_BUFFER; - - rc = select_sec(sess_data); + rc = select_sec(&sess_data); if (rc) goto out; - while (sess_data->func) - sess_data->func(sess_data); + while (sess_data.func) + sess_data.func(&sess_data); - /* Store result before we free sess_data */ - rc = sess_data->result; + rc = sess_data.result; out: - kfree_sensitive(sess_data); + memzero_explicit(&sess_data, sizeof(sess_data)); return rc; } -- cgit v1.2.3