From: Paulo Alcantara <pc@manguebit.com>
Date: Tue, 2 Apr 2024 19:33:56 +0000 (-0300)
Subject: smb: client: fix potential UAF in cifs_stats_proc_show()
X-Git-Tag: v6.6.26~32
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c3cf8b74c57924c0985e49a1fdf02d3395111f39;p=thirdparty%2Fkernel%2Fstable.git

smb: client: fix potential UAF in cifs_stats_proc_show()

commit 0865ffefea197b437ba78b5dd8d8e256253efd65 upstream.

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
index b4d2ee2d5e6c7..6c85edb8635d0 100644
--- a/fs/smb/client/cifs_debug.c
+++ b/fs/smb/client/cifs_debug.c
@@ -736,6 +736,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
 			}
 #endif /* STATS2 */
 		list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+			if (cifs_ses_exiting(ses))
+				continue;
 			list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 				i++;
 				seq_printf(m, "\n%d) %s", i, tcon->tree_name);