Test the password field as well as the username field when looking for a session to reuse.
If this is not done then it will be possible to mount a CIFS share using an incorrect
password, provided there is an existing session to the same server with the same user.
Signed-off-by: Alex Zeffertt <alex.zeffertt@eu.citrix.com>
@@ -1587,7 +1587,7 @@
}
static struct cifsSesInfo *
-cifs_find_smb_ses(struct TCP_Server_Info *server, char *username)
+cifs_find_smb_ses(struct TCP_Server_Info *server, char *username, char *password)
{
struct list_head *tmp;
struct cifsSesInfo *ses;
@@ -1597,6 +1597,17 @@
ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
if (strncmp(ses->userName, username, MAX_USERNAME_SIZE))
continue;
+ if (password) {
+ if (!ses->password)
+ continue;
+ if (strcmp(ses->password, password))
+ continue;
+ } else {
+ if (ses->password)
+ continue;
+ }
+
+
++ses->ses_count;
write_unlock(&cifs_tcp_ses_lock);
@@ -2356,7 +2367,7 @@
goto out;
}
- pSesInfo = cifs_find_smb_ses(srvTcp, volume_info->username);
+ pSesInfo = cifs_find_smb_ses(srvTcp, volume_info->username, volume_info->password);
if (pSesInfo) {
cFYI(1, ("Existing smb sess found (status=%d)",
pSesInfo->status));