ksmbd: fix Preauh_HashValue race condition

If client send multiple session setup requests to ksmbd,
Preauh_HashValue race condition could happen.
There is no need to free sess->Preauh_HashValue at session setup phase.
It can be freed together with session at connection termination phase.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27661
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index b46fbc8087e0c0ef2a32fa8547423c89ae598b75..6fc6ad63d004d346e99defc5bb1634f1d0e5e3e4 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1852,8 +1852,6 @@ int smb2_sess_setup(struct ksmbd_work *work)
                                ksmbd_conn_set_good(conn);
                                sess->state = SMB2_SESSION_VALID;
                        }
-                       kfree(sess->Preauth_HashValue);
-                       sess->Preauth_HashValue = NULL;
                } else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) {
                        if (negblob->MessageType == NtLmNegotiate) {
                                rc = ntlm_negotiate(work, negblob, negblob_len, rsp);
@@ -1880,8 +1878,6 @@ int smb2_sess_setup(struct ksmbd_work *work)
                                                kfree(preauth_sess);
                                        }
                                }
-                               kfree(sess->Preauth_HashValue);
-                               sess->Preauth_HashValue = NULL;
                        } else {
                                pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n",
                                                le32_to_cpu(negblob->MessageType));