github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-27 08:33:17 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

cifs: fix NULL dereference in smb2_check_message()

Browse Source 
This code sets "ses" to NULL which will lead to a NULL dereference on
the second iteration through the loop.

Fixes: 85346c17e425 ("cifs: convert list_for_each to entry variant in smb2misc.c")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Dan Carpenter 2021-06-22 13:59:55 +03:00 committed by Steve French
parent 0555b22152
commit 1689b0b554
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/cifs/smb2misc.c
View File

@ -158,11 +158,10 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr)
list_for_each_entry(ses, &srvr->smb_ses_list, smb_ses_list) {
if (ses->Suid == thdr->SessionId)
break;
ses = NULL;
}
spin_unlock(&cifs_tcp_ses_lock);
if (ses == NULL) {
if (list_entry_is_head(ses, &srvr->smb_ses_list,
smb_ses_list)) {
cifs_dbg(VFS, "no decryption - session id not found\n");
return 1;
}