Isn't this needed to send the SMB3 Logoff request?
On Tue, Apr 2, 2024 at 2:35 PM Paulo Alcantara <pc@xxxxxxxxxxxxx> wrote:
>
> Skip sessions that are being teared down (status == SES_EXITING) to
> avoid UAF.
>
> Signed-off-by: Paulo Alcantara (Red Hat) <pc@xxxxxxxxxxxxx>
> ---
> fs/smb/client/smb2ops.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
> index 1506a0eb10ba..4fd2ffa2ebba 100644
> --- a/fs/smb/client/smb2ops.c
> +++ b/fs/smb/client/smb2ops.c
> @@ -4188,8 +4188,8 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key)
>
> spin_lock(&cifs_tcp_ses_lock);
> list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
> - if (ses->Suid == ses_id) {
> - spin_lock(&ses->ses_lock);
> + spin_lock(&ses->ses_lock);
> + if (ses->ses_status != SES_EXITING && ses->Suid == ses_id) {
> ses_enc_key = enc ? ses->smb3encryptionkey :
> ses->smb3decryptionkey;
> memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE);
> @@ -4197,6 +4197,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key)
> spin_unlock(&cifs_tcp_ses_lock);
> return 0;
> }
> + spin_unlock(&ses->ses_lock);
> }
> spin_unlock(&cifs_tcp_ses_lock);
>
> --
> 2.44.0
>
>
--
Thanks,
Steve
