Commit 58acd1f4 authored by Paulo Alcantara's avatar Paulo Alcantara Committed by Steve French
Browse files

smb: client: fix potential UAF in cifs_dump_full_key() 



Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent ca545b7f

fs/smb/client/ioctl.c

+5 −1
Original line number Diff line number Diff line
@@ -247,7 +247,9 @@ static int cifs_dump_full_key(struct cifs_tcon *tcon, struct smb3_full_key_debug 
		spin_lock(&cifs_tcp_ses_lock);

		list_for_each_entry(server_it, &cifs_tcp_ses_list, tcp_ses_list) {

			list_for_each_entry(ses_it, &server_it->smb_ses_list, smb_ses_list) {

				if (ses_it->Suid == out.session_id) {

				spin_lock(&ses_it->ses_lock);

				if (ses_it->ses_status != SES_EXITING &&

				    ses_it->Suid == out.session_id) {

					ses = ses_it;

					/*

					 * since we are using the session outside the crit
@@ -255,9 +257,11 @@ static int cifs_dump_full_key(struct cifs_tcon *tcon, struct smb3_full_key_debug 
					 * so increment its refcount

					 */

					cifs_smb_ses_inc_refcount(ses);

					spin_unlock(&ses_it->ses_lock);

					found = true;

					goto search_end;

				}

				spin_unlock(&ses_it->ses_lock);

			}

		}

search_end: