Commit 2fc9feff authored by Sean Heelan's avatar Sean Heelan Committed by Steve French
Browse files

ksmbd: fix use-after-free in session logoff 



The sess->user object can currently be in use by another thread, for
example if another connection has sent a session setup request to
bind to the session being free'd. The handler for that connection could
be in the smb2_sess_setup function which makes use of sess->user.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarSean Heelan <seanheelan@gmail.com>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent e86e9134

fs/smb/server/smb2pdu.c

+0 −4
Original line number Diff line number Diff line
@@ -2249,10 +2249,6 @@ int smb2_session_logoff(struct ksmbd_work *work) 
	sess->state = SMB2_SESSION_EXPIRED;

	up_write(&conn->session_lock);



	if (sess->user) {

		ksmbd_free_user(sess->user);

		sess->user = NULL;

	}

	ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP);



	rsp->StructureSize = cpu_to_le16(4);