Commit 15a9605f authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: fix use-after-free in ksmbd_sessions_deregister() 



In multichannel mode, UAF issue can occur in session_deregister
when the second channel sets up a session through the connection of
the first channel. session that is freed through the global session
table can be accessed again through ->sessions of connection.

Cc: stable@vger.kernel.org
Reported-by: default avatarNorbert Szetei <norbert@doyensec.com>
Tested-by: default avatarNorbert Szetei <norbert@doyensec.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 6955bfef

fs/smb/server/mgmt/user_session.c

+3 −0
Original line number Diff line number Diff line
@@ -230,6 +230,9 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn) 
			if (!ksmbd_chann_del(conn, sess) &&

			    xa_empty(&sess->ksmbd_chann_list)) {

				hash_del(&sess->hlist);

				down_write(&conn->session_lock);

				xa_erase(&conn->sessions, sess->id);

				up_write(&conn->session_lock);

				ksmbd_session_destroy(sess);

			}

		}