32 lines
1.2 KiB
Diff
32 lines
1.2 KiB
Diff
From d72853120541d47779616db780a15a42afe4ad9b Mon Sep 17 00:00:00 2001
|
|
From: Namjae Jeon <linkinjeon@kernel.org>
|
|
Date: Sat, 22 Mar 2025 09:20:19 +0900
|
|
Subject: ksmbd: fix use-after-free in ksmbd_sessions_deregister()
|
|
|
|
In multichannel mode, UAF issue can occur in session_deregister
|
|
when the second channel sets up a session through the connection of
|
|
the first channel. session that is freed through the global session
|
|
table can be accessed again through ->sessions of connection.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Reported-by: Norbert Szetei <norbert@doyensec.com>
|
|
Tested-by: Norbert Szetei <norbert@doyensec.com>
|
|
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
Signed-off-by: Steve French <stfrench@microsoft.com>
|
|
---
|
|
fs/smb/server/mgmt/user_session.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
--- a/fs/smb/server/mgmt/user_session.c
|
|
+++ b/fs/smb/server/mgmt/user_session.c
|
|
@@ -230,6 +230,9 @@ void ksmbd_sessions_deregister(struct ks
|
|
if (!ksmbd_chann_del(conn, sess) &&
|
|
xa_empty(&sess->ksmbd_chann_list)) {
|
|
hash_del(&sess->hlist);
|
|
+ down_write(&conn->session_lock);
|
|
+ xa_erase(&conn->sessions, sess->id);
|
|
+ up_write(&conn->session_lock);
|
|
ksmbd_session_destroy(sess);
|
|
}
|
|
}
|