Commit 39e8db3c authored by Paulo Alcantara's avatar Paulo Alcantara Committed by Steve French
Browse files

cifs: fix double free on failed kerberos auth 



If session setup failed with kerberos auth, we ended up freeing
cifs_ses::auth_key.response twice in SMB2_auth_kerberos() and
sesInfoFree().

Fix this by zeroing out cifs_ses::auth_key.response after freeing it
in SMB2_auth_kerberos().

Fixes: a4e430c8 ("cifs: replace kfree() with kfree_sensitive() for sensitive data")
Signed-off-by: default avatarPaulo Alcantara (SUSE) <pc@cjr.nz>
Acked-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 2f57e446

fs/cifs/smb2pdu.c

+4 −1
Original line number Diff line number Diff line
@@ -1482,8 +1482,11 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 
out_put_spnego_key:

	key_invalidate(spnego_key);

	key_put(spnego_key);

	if (rc)

	if (rc) {

		kfree_sensitive(ses->auth_key.response);

		ses->auth_key.response = NULL;

		ses->auth_key.len = 0;

	}

out:

	sess_data->result = rc;

	sess_data->func = NULL;