Commit 4951a84f authored by Colin Ian King's avatar Colin Ian King Committed by Namjae Jeon
Browse files

ksmbd: Fix read on the uninitialized pointer sess 



There is a error handling case that passes control to label out_err
without pointer sess being assigned a value. The unassigned pointer
may be any garbage value and so the test of rc < 0 && sess maybe
true leading to sess being passed to the call to ksmbd_session_destroy.
Fix this by setting sess to NULL in this corner case.

Addresses-Coverity: ("Uninitialized pointer read")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarNamjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 465d7204

fs/ksmbd/smb2pdu.c

+1 −0
Original line number Diff line number Diff line
@@ -1615,6 +1615,7 @@ int smb2_sess_setup(struct ksmbd_work *work) 
	} else if ((conn->dialect < SMB30_PROT_ID ||

		    server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) &&

		   (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {

		sess = NULL;

		rc = -EACCES;

		goto out_err;

	} else {