aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMarios Makassikis <[email protected]>2021-05-06 11:41:54 +0900
committerSteve French <[email protected]>2021-05-10 19:15:48 -0500
commit1fca8038e9f10bc14eb3484d212b3f03b49ac3f5 (patch)
tree00569f801fcc95ee39abc39b36ce6c6a90cd78ae
parente7735c854880084a6d97e60465f19daa42842eff (diff)
cifsd: Fix potential null-ptr-deref in destroy_previous_session()
The user field in the session structure is allocated when the client is authenticated. If the client explicitly logs off, the user field is freed, but the session is kept around in case the user reconnects. If the TCP connection hasn't been closed and the client sends a session setup with a PreviousSessionId set, destroy_previous_session() will be called to check if the session needs to be cleaned up. Signed-off-by: Marios Makassikis <[email protected]> Signed-off-by: Namjae Jeon <[email protected]> Signed-off-by: Steve French <[email protected]>
-rw-r--r--fs/cifsd/smb2pdu.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/cifsd/smb2pdu.c b/fs/cifsd/smb2pdu.c
index 54df9a30bd23..ebae992f88a0 100644
--- a/fs/cifsd/smb2pdu.c
+++ b/fs/cifsd/smb2pdu.c
@@ -619,7 +619,8 @@ static void destroy_previous_session(struct ksmbd_user *user, u64 id)
prev_user = prev_sess->user;
- if (strcmp(user->name, prev_user->name) ||
+ if (!prev_user ||
+ strcmp(user->name, prev_user->name) ||
user->passkey_sz != prev_user->passkey_sz ||
memcmp(user->passkey, prev_user->passkey, user->passkey_sz)) {
put_session(prev_sess);