Skip to content

Commit

Permalink
smb: client: fix potential UAF in cifs_stats_proc_show()
Browse files Browse the repository at this point in the history
commit 0865ffe upstream.

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[ cifs_debug.c was moved from fs/cifs to fs/smb/client since
  38c8a9a ("smb: move client and server files to common directory fs/smb").
  The cifs_ses_exiting() was introduced to cifs_debug.c since
  ca545b7 ("smb: client: fix potential UAF in cifs_debug_files_proc_show()")
  which has been sent to upstream already. ]
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Paulo Alcantara authored and Greg Kroah-Hartman committed May 2, 2025
1 parent 99f476e commit 838ec01
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions fs/cifs/cifs_debug.c
Original file line number Diff line number Diff line change
Expand Up @@ -595,6 +595,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
list_for_each(tmp2, &server->smb_ses_list) {
ses = list_entry(tmp2, struct cifs_ses,
smb_ses_list);
if (cifs_ses_exiting(ses))
continue;
list_for_each(tmp3, &ses->tcon_list) {
tcon = list_entry(tmp3,
struct cifs_tcon,
Expand Down

0 comments on commit 838ec01

Please sign in to comment.