summaryrefslogtreecommitdiff
path: root/fs/cifs/smb2pdu.c
diff options
context:
space:
mode:
authorPaulo Alcantara <pc@cjr.nz>2023-01-10 23:55:20 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2023-01-18 13:58:15 +0300
commitf0f326dc9794cc5820e0804d8702d5a10fb84aca (patch)
tree7641dff22def76114268c1c6764c4b3560b30a7b /fs/cifs/smb2pdu.c
parent888c060bc327e6a231304aefc0f30e97b1640338 (diff)
downloadlinux-f0f326dc9794cc5820e0804d8702d5a10fb84aca.tar.xz
cifs: fix double free on failed kerberos auth
commit 39e8db3c860e2678ce5a7d74193925876507c9eb upstream. If session setup failed with kerberos auth, we ended up freeing cifs_ses::auth_key.response twice in SMB2_auth_kerberos() and sesInfoFree(). Fix this by zeroing out cifs_ses::auth_key.response after freeing it in SMB2_auth_kerberos(). Fixes: a4e430c8c8ba ("cifs: replace kfree() with kfree_sensitive() for sensitive data") Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz> Acked-by: Ronnie Sahlberg <lsahlber@redhat.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/cifs/smb2pdu.c')
-rw-r--r--fs/cifs/smb2pdu.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index a5695748a89b..4ac5b1bfaf78 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1479,8 +1479,11 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
out_put_spnego_key:
key_invalidate(spnego_key);
key_put(spnego_key);
- if (rc)
+ if (rc) {
kfree_sensitive(ses->auth_key.response);
+ ses->auth_key.response = NULL;
+ ses->auth_key.len = 0;
+ }
out:
sess_data->result = rc;
sess_data->func = NULL;