diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2024-12-05 21:38:47 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-19 18:12:58 +0100 |
| commit | a39e31e22a535d47b14656a7d6a893c7f6cf758c (patch) | |
| tree | 039856850e42b5c31cf2e73dc9e660adf8130aaf /fs/smb/server/auth.c | |
| parent | 0535f67fbafa9dec48320169e3742f8511e4acb6 (diff) | |
ksmbd: fix racy issue from session lookup and expire
commit b95629435b84b9ecc0c765995204a4d8a913ed52 upstream.
Increment the session reference count within the lock for lookup to avoid
racy issue with session expire.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-25737
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/smb/server/auth.c')
| -rw-r--r-- | fs/smb/server/auth.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c index 611716bc8f27c..8892177e500f1 100644 --- a/fs/smb/server/auth.c +++ b/fs/smb/server/auth.c @@ -1016,6 +1016,8 @@ static int ksmbd_get_encryption_key(struct ksmbd_work *work, __u64 ses_id, ses_enc_key = enc ? sess->smb3encryptionkey : sess->smb3decryptionkey; + if (enc) + ksmbd_user_session_get(sess); memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE); return 0; |