diff options
| author | Colin Ian King <colin.king@canonical.com> | 2021-07-06 15:05:01 +0300 |
|---|---|---|
| committer | Namjae Jeon <namjae.jeon@samsung.com> | 2021-07-06 16:06:32 +0300 |
| commit | 4951a84f61d6de4ab5aca1d49a6b6ee2ad2d1eec (patch) | |
| tree | 3374da92a64b7ea2e4d4225df9a25e9b7a2ef4d4 /fs/ksmbd | |
| parent | 465d720485eff1468503d210b1b966660f5f9b85 (diff) | |
| download | linux-4951a84f61d6de4ab5aca1d49a6b6ee2ad2d1eec.tar.xz | |
ksmbd: Fix read on the uninitialized pointer sess
There is a error handling case that passes control to label out_err
without pointer sess being assigned a value. The unassigned pointer
may be any garbage value and so the test of rc < 0 && sess maybe
true leading to sess being passed to the call to ksmbd_session_destroy.
Fix this by setting sess to NULL in this corner case.
Addresses-Coverity: ("Uninitialized pointer read")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/ksmbd')
| -rw-r--r-- | fs/ksmbd/smb2pdu.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index d4ef8f55fa4b..994b95b6b3c2 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1615,6 +1615,7 @@ int smb2_sess_setup(struct ksmbd_work *work) } else if ((conn->dialect < SMB30_PROT_ID || server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { + sess = NULL; rc = -EACCES; goto out_err; } else { |