diff options
| author | Paulo Alcantara <pc@cjr.nz> | 2023-01-10 17:55:20 -0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-01-10 15:32:03 -0600 |
| commit | 39e8db3c860e2678ce5a7d74193925876507c9eb (patch) | |
| tree | fb5cbca42dd71bdfd661772ed4195945b3d610d5 /fs/cifs/smb2pdu.c | |
| parent | 2f57e4464cddfceda850ae4224779d11b6eb171f (diff) | |
cifs: fix double free on failed kerberos auth
If session setup failed with kerberos auth, we ended up freeing
cifs_ses::auth_key.response twice in SMB2_auth_kerberos() and
sesInfoFree().
Fix this by zeroing out cifs_ses::auth_key.response after freeing it
in SMB2_auth_kerberos().
Fixes: a4e430c8c8ba ("cifs: replace kfree() with kfree_sensitive() for sensitive data")
Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/cifs/smb2pdu.c')
| -rw-r--r-- | fs/cifs/smb2pdu.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 2c484d47c592..727f16b426be 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -1482,8 +1482,11 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) out_put_spnego_key: key_invalidate(spnego_key); key_put(spnego_key); - if (rc) + if (rc) { kfree_sensitive(ses->auth_key.response); + ses->auth_key.response = NULL; + ses->auth_key.len = 0; + } out: sess_data->result = rc; sess_data->func = NULL; |