32 lines
1.1 KiB
Diff
32 lines
1.1 KiB
Diff
From 818b4d086f287e0a5cc6368eb72703b68b0603d0 Mon Sep 17 00:00:00 2001
|
|
From: Sean Heelan <seanheelan@gmail.com>
|
|
Date: Mon, 21 Apr 2025 15:39:29 +0000
|
|
Subject: ksmbd: fix use-after-free in session logoff
|
|
|
|
The sess->user object can currently be in use by another thread, for
|
|
example if another connection has sent a session setup request to
|
|
bind to the session being free'd. The handler for that connection could
|
|
be in the smb2_sess_setup function which makes use of sess->user.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Sean Heelan <seanheelan@gmail.com>
|
|
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
Signed-off-by: Steve French <stfrench@microsoft.com>
|
|
---
|
|
fs/smb/server/smb2pdu.c | 4 ----
|
|
1 file changed, 4 deletions(-)
|
|
|
|
--- a/fs/smb/server/smb2pdu.c
|
|
+++ b/fs/smb/server/smb2pdu.c
|
|
@@ -2244,10 +2244,6 @@ int smb2_session_logoff(struct ksmbd_wor
|
|
sess->state = SMB2_SESSION_EXPIRED;
|
|
up_write(&conn->session_lock);
|
|
|
|
- if (sess->user) {
|
|
- ksmbd_free_user(sess->user);
|
|
- sess->user = NULL;
|
|
- }
|
|
ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP);
|
|
|
|
rsp->StructureSize = cpu_to_le16(4);
|