smb: client: fix memory leak during error handling for POSIX mkdir

JIRA: https://issues.redhat.com/browse/RHEL-96872

commit 1fe4a44
Author: Jethro Donaldson <[email protected]>
Date:   Thu May 15 01:23:23 2025 +1200

    smb: client: fix memory leak during error handling for POSIX mkdir
    
    The response buffer for the CREATE request handled by smb311_posix_mkdir()
    is leaked on the error path (goto err_free_rsp_buf) because the structure
    pointer *rsp passed to free_rsp_buf() is not assigned until *after* the
    error condition is checked.
    
    As *rsp is initialised to NULL, free_rsp_buf() becomes a no-op and the leak
    is instead reported by __kmem_cache_shutdown() upon subsequent rmmod of
    cifs.ko if (and only if) the error path has been hit.
    
    Pass rsp_iov.iov_base to free_rsp_buf() instead, similar to the code in
    other functions in smb2pdu.c for which *rsp is assigned late.
    
    Cc: [email protected]
    Signed-off-by: Jethro Donaldson <[email protected]>
    Signed-off-by: Steve French <[email protected]>

Signed-off-by: Paulo Alcantara <[email protected]>

Author: pcacjr

fs/smb/client/smb2pdu.c

@@ -2975,7 +2975,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
 	/* Eventually save off posix specific response info and timestamps */
 
 err_free_rsp_buf:
-	free_rsp_buf(resp_buftype, rsp);
+	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
 	kfree(pc_buf);
 err_free_req:
 	cifs_small_buf_release(req);