Skip to content

Commit 1fd7ad6

Browse files
Paulo Alcantaravijay-suman
authored andcommitted
smb: client: fix potential UAF in cifs_stats_proc_show()
commit 0865ffe upstream. Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Cc: [email protected] Signed-off-by: Paulo Alcantara (Red Hat) <[email protected]> Signed-off-by: Steve French <[email protected]> [ cifs_debug.c was moved from fs/cifs to fs/smb/client since 38c8a9a ("smb: move client and server files to common directory fs/smb"). The cifs_ses_exiting() was introduced to cifs_debug.c since ca545b7 ("smb: client: fix potential UAF in cifs_debug_files_proc_show()") which has been sent to upstream already. ] Signed-off-by: Jianqi Ren <[email protected]> Signed-off-by: He Zhe <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit bb6570085826291dc392005f9fec16ea5da3c8ad) Signed-off-by: Vijayendra Suman <[email protected]>
1 parent bc593fe commit 1fd7ad6

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

fs/cifs/cifs_debug.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -613,6 +613,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
613613
list_for_each(tmp2, &server->smb_ses_list) {
614614
ses = list_entry(tmp2, struct cifs_ses,
615615
smb_ses_list);
616+
if (cifs_ses_exiting(ses))
617+
continue;
616618
list_for_each(tmp3, &ses->tcon_list) {
617619
tcon = list_entry(tmp3,
618620
struct cifs_tcon,

0 commit comments

Comments
 (0)