Commit 44a3059c authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: fix Preauh_HashValue race condition 



If client send multiple session setup requests to ksmbd,
Preauh_HashValue race condition could happen.
There is no need to free sess->Preauh_HashValue at session setup phase.
It can be freed together with session at connection termination phase.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27661
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent ecd9d6bf

fs/smb/server/smb2pdu.c

+0 −4
Original line number Diff line number Diff line
@@ -1852,8 +1852,6 @@ int smb2_sess_setup(struct ksmbd_work *work) 
				ksmbd_conn_set_good(conn);

				sess->state = SMB2_SESSION_VALID;

			}

			kfree(sess->Preauth_HashValue);

			sess->Preauth_HashValue = NULL;

		} else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) {

			if (negblob->MessageType == NtLmNegotiate) {

				rc = ntlm_negotiate(work, negblob, negblob_len, rsp);
@@ -1880,8 +1878,6 @@ int smb2_sess_setup(struct ksmbd_work *work) 
						kfree(preauth_sess);

					}

				}

				kfree(sess->Preauth_HashValue);

				sess->Preauth_HashValue = NULL;

			} else {

				pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n",

						le32_to_cpu(negblob->MessageType));