Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@xxxxxxxxxxxxx>
---
fs/smb/client/smb2misc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
index 82b84a4941dd..14d74ef70cc8 100644
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -160,7 +160,8 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server)
/* decrypt frame now that it is completely read in */
spin_lock(&cifs_tcp_ses_lock);
list_for_each_entry(iter, &pserver->smb_ses_list, smb_ses_list) {
- if (iter->Suid == le64_to_cpu(thdr->SessionId)) {
+ if (!cifs_ses_exiting(iter) &&
+ iter->Suid == le64_to_cpu(thdr->SessionId)) {
ses = iter;
break;
}
--
2.44.0
