From 1689b0b554defd5a7863bbd434ae911b8869504a Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 22 Jun 2021 13:59:55 +0300 Subject: cifs: fix NULL dereference in smb2_check_message() This code sets "ses" to NULL which will lead to a NULL dereference on the second iteration through the loop. Fixes: 85346c17e425 ("cifs: convert list_for_each to entry variant in smb2misc.c") Signed-off-by: Dan Carpenter Reviewed-by: Aurelien Aptel Signed-off-by: Steve French --- fs/cifs/smb2misc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'fs/cifs') diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index c6bb2ea1983b..668f77108831 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -158,11 +158,10 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr) list_for_each_entry(ses, &srvr->smb_ses_list, smb_ses_list) { if (ses->Suid == thdr->SessionId) break; - - ses = NULL; } spin_unlock(&cifs_tcp_ses_lock); - if (ses == NULL) { + if (list_entry_is_head(ses, &srvr->smb_ses_list, + smb_ses_list)) { cifs_dbg(VFS, "no decryption - session id not found\n"); return 1; } -- cgit v1.2.3-70-g09d2