projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 98979065 GKH |
1 | From d3da25c5ac84430f89875ca7485a3828150a7e0a Mon Sep 17 00:00:00 2001 |
| 2 | From: Paulo Alcantara <pc@manguebit.com> | |
| 3 | Date: Tue, 2 Apr 2024 16:33:55 -0300 | |
| 4 | Subject: smb: client: fix potential UAF in cifs_stats_proc_write() | |
| 5 | ||
| 6 | From: Paulo Alcantara <pc@manguebit.com> | |
| 7 | ||
| 8 | commit d3da25c5ac84430f89875ca7485a3828150a7e0a upstream. | |
| 9 | ||
| 10 | Skip sessions that are being teared down (status == SES_EXITING) to | |
| 11 | avoid UAF. | |
| 12 | ||
| 13 | Cc: stable@vger.kernel.org | |
| 14 | Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> | |
| 15 | Signed-off-by: Steve French <stfrench@microsoft.com> | |
| 16 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 17 | --- | |
| 18 | fs/smb/client/cifs_debug.c | 2 ++ | |
| 19 | 1 file changed, 2 insertions(+) | |
| 20 | ||
| 21 | --- a/fs/smb/client/cifs_debug.c | |
| 22 | +++ b/fs/smb/client/cifs_debug.c | |
| 23 | @@ -656,6 +656,8 @@ static ssize_t cifs_stats_proc_write(str | |
| 24 | } | |
| 25 | #endif /* CONFIG_CIFS_STATS2 */ | |
| 26 | list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { | |
| 27 | + if (cifs_ses_exiting(ses)) | |
| 28 | + continue; | |
| 29 | list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { | |
| 30 | atomic_set(&tcon->num_smbs_sent, 0); | |
| 31 | spin_lock(&tcon->stat_lock); |