diff options
| author |   Sean Heelan <seanheelan@gmail.com> | 2025-04-21 15:39:29 +0000 |
|---|---|---|
| committer |   Steve French <stfrench@microsoft.com> | 2025-04-25 18:22:26 -0500 |
| commit | 2fc9feff45d92a92cd5f96487655d5be23fb7e2b (patch) | |
| tree | 11327ea1b1ed45aa5863741dcf3c864c89b48f12 | |
| parent | ksmbd: fix use-after-free in kerberos authentication (diff) | |
| download | wireguard-linux-2fc9feff45d92a92cd5f96487655d5be23fb7e2b.tar.xz wireguard-linux-2fc9feff45d92a92cd5f96487655d5be23fb7e2b.zip | |
ksmbd: fix use-after-free in session logoff
The sess->user object can currently be in use by another thread, for
example if another connection has sent a session setup request to
bind to the session being free'd. The handler for that connection could
be in the smb2_sess_setup function which makes use of sess->user.
Cc: stable@vger.kernel.org
Signed-off-by: Sean Heelan <seanheelan@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index acc05657cfc7..46aa08245742 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2249,10 +2249,6 @@ int smb2_session_logoff(struct ksmbd_work *work) sess->state = SMB2_SESSION_EXPIRED; up_write(&conn->session_lock); - if (sess->user) { - ksmbd_free_user(sess->user); - sess->user = NULL; - } ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP); rsp->StructureSize = cpu_to_le16(4); |