This is a note to let you know that I've just added the patch titled
cifs: fix double free on failed kerberos auth
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cifs-fix-double-free-on-failed-kerberos-auth.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 39e8db3c860e2678ce5a7d74193925876507c9eb Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@xxxxxx>
Date: Tue, 10 Jan 2023 17:55:20 -0300
Subject: cifs: fix double free on failed kerberos auth
From: Paulo Alcantara <pc@xxxxxx>
commit 39e8db3c860e2678ce5a7d74193925876507c9eb upstream.
If session setup failed with kerberos auth, we ended up freeing
cifs_ses::auth_key.response twice in SMB2_auth_kerberos() and
sesInfoFree().
Fix this by zeroing out cifs_ses::auth_key.response after freeing it
in SMB2_auth_kerberos().
Fixes: a4e430c8c8ba ("cifs: replace kfree() with kfree_sensitive() for sensitive data")
Signed-off-by: Paulo Alcantara (SUSE) <pc@xxxxxx>
Acked-by: Ronnie Sahlberg <lsahlber@xxxxxxxxxx>
Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/cifs/smb2pdu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1479,8 +1479,11 @@ SMB2_auth_kerberos(struct SMB2_sess_data
out_put_spnego_key:
key_invalidate(spnego_key);
key_put(spnego_key);
- if (rc)
+ if (rc) {
kfree_sensitive(ses->auth_key.response);
+ ses->auth_key.response = NULL;
+ ses->auth_key.len = 0;
+ }
out:
sess_data->result = rc;
sess_data->func = NULL;
Patches currently in stable-queue which might be from pc@xxxxxx are
queue-6.1/cifs-fix-double-free-on-failed-kerberos-auth.patch
queue-6.1/cifs-fix-uninitialized-memory-read-for-smb311-posix-symlink-create.patch
queue-6.1/cifs-do-not-query-ifaces-on-smb1-mounts.patch
queue-6.1/cifs-fix-file-info-setting-in-cifs_query_path_info.patch
queue-6.1/cifs-fix-file-info-setting-in-cifs_open_file.patch
