Commit 1689b0b5 authored Jun 22, 2021 by Dan Carpenter Committed by Steve French Jun 23, 2021

cifs: fix NULL dereference in smb2_check_message()



This code sets "ses" to NULL which will lead to a NULL dereference on
the second iteration through the loop.

Fixes: 85346c17e425 ("cifs: convert list_for_each to entry variant in smb2misc.c")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

parent 0555b221

fs/cifs/smb2misc.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -158,11 +158,10 @@ smb2_check_message(char buf, unsigned int len, struct TCP_Server_Info srvr)
		list_for_each_entry(ses, &srvr->smb_ses_list, smb_ses_list) {
		if (ses->Suid == thdr->SessionId)
		break;

		ses = NULL;
		}
		spin_unlock(&cifs_tcp_ses_lock);
		if (ses == NULL) {
		if (list_entry_is_head(ses, &srvr->smb_ses_list,
		smb_ses_list)) {
		cifs_dbg(VFS, "no decryption - session id not found\n");
		return 1;
		}