diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2025-07-25 08:13:31 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2025-07-24 22:55:29 -0500 |
| commit | 44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6 (patch) | |
| tree | face3b90dd941c691af0ad9f01c6c8d76695959f | |
| parent | ksmbd: check return value of xa_store() in krb5_authenticate (diff) | |
| download | linux-44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6.tar.gz linux-44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6.zip | |
ksmbd: fix Preauh_HashValue race condition
If client send multiple session setup requests to ksmbd,
Preauh_HashValue race condition could happen.
There is no need to free sess->Preauh_HashValue at session setup phase.
It can be freed together with session at connection termination phase.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27661
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index b46fbc8087e0..6fc6ad63d004 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -1852,8 +1852,6 @@ int smb2_sess_setup(struct ksmbd_work *work) ksmbd_conn_set_good(conn); sess->state = SMB2_SESSION_VALID; } - kfree(sess->Preauth_HashValue); - sess->Preauth_HashValue = NULL; } else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) { if (negblob->MessageType == NtLmNegotiate) { rc = ntlm_negotiate(work, negblob, negblob_len, rsp); @@ -1880,8 +1878,6 @@ int smb2_sess_setup(struct ksmbd_work *work) kfree(preauth_sess); } } - kfree(sess->Preauth_HashValue); - sess->Preauth_HashValue = NULL; } else { pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", le32_to_cpu(negblob->MessageType)); |