smb: client: fix potential UAF in cifs_dump_full_key()

commit 58acd1f upstream.

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Cc: [email protected]
Signed-off-by: Paulo Alcantara (Red Hat) <[email protected]>
Signed-off-by: Steve French <[email protected]>
[ This patch removes lock/unlock operation in routine cifs_dump_full_key()
  for ses_lock is not present in v5.15 and not ported yet. ses->status
  is protected by a global lock, cifs_tcp_ses_lock, in v5.15.  ]
Signed-off-by: Jianqi Ren <[email protected]>
Signed-off-by: He Zhe <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit d798fd98e3563027c5162259ead517057d6fa794)
Signed-off-by: Vijayendra Suman <[email protected]>

Author: Paulo Alcantara

fs/cifs/ioctl.c

@@ -232,7 +232,8 @@ static int cifs_dump_full_key(struct cifs_tcon *tcon, struct smb3_full_key_debug
 		spin_lock(&cifs_tcp_ses_lock);
 		list_for_each_entry(server_it, &cifs_tcp_ses_list, tcp_ses_list) {
 			list_for_each_entry(ses_it, &server_it->smb_ses_list, smb_ses_list) {
-				if (ses_it->Suid == out.session_id) {
+				if (ses_it->status != CifsExiting &&
+				    ses_it->Suid == out.session_id) {
 					ses = ses_it;
 					/*
 					 * since we are using the session outside the crit