Blaster4385/linux-IllusionX
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

cifs: fix double-fault crash during ntlmssp

Browse source 
The crash occurred because we were calling memzero_explicit() on an
already freed sess_data::iov[1] (ntlmsspblob) in sess_free_buffer().

Fix this by not calling memzero_explicit() on sess_data::iov[1] as
it's already by handled by callers.

Fixes: a4e430c8c8 ("cifs: replace kfree() with kfree_sensitive() for sensitive data")
Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Paulo Alcantara 2022-10-14 17:14:54 -03:00 committed by Steve French
parent a9e17d3d74
commit b854b4ee66
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
fs/cifs/sess.c
View file

@ -1208,16 +1208,18 @@ out_free_smb_buf:
static void
sess_free_buffer(struct sess_data *sess_data)
{
int i;
struct kvec *iov = sess_data->iov;
/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
for (i = 0; i < 3; i++)
if (sess_data->iov[i].iov_base)
memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
/*
* Zero the session data before freeing, as it might contain sensitive info (keys, etc).
* Note that iov[1] is already freed by caller.
*/
if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
memzero_explicit(iov[0].iov_base, iov[0].iov_len);
free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
sess_data->buf0_type = CIFS_NO_BUFFER;
kfree(sess_data->iov[2].iov_base);
kfree_sensitive(iov[2].iov_base);
}
static int