diff mbox series

[05/12] smb: client: fix potential UAF in smb2_check_message()

Message ID 20240402193404.236159-5-pc@manguebit.com (mailing list archive)
State New, archived
Headers show
Series [01/12] smb: client: fix potential UAF in cifs_debug_files_proc_show() | expand

Commit Message

Paulo Alcantara April 2, 2024, 7:33 p.m. UTC 
Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
---
 fs/smb/client/smb2misc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
index 82b84a4941dd..14d74ef70cc8 100644
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -160,7 +160,8 @@  smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server)
 		/* decrypt frame now that it is completely read in */
 		spin_lock(&cifs_tcp_ses_lock);
 		list_for_each_entry(iter, &pserver->smb_ses_list, smb_ses_list) {
-			if (iter->Suid == le64_to_cpu(thdr->SessionId)) {
+			if (!cifs_ses_exiting(iter) &&
+			    iter->Suid == le64_to_cpu(thdr->SessionId)) {
 				ses = iter;
 				break;
 			}