Commit b854b4ee authored by Paulo Alcantara's avatar Paulo Alcantara Committed by Steve French
Browse files

cifs: fix double-fault crash during ntlmssp 



The crash occurred because we were calling memzero_explicit() on an
already freed sess_data::iov[1] (ntlmsspblob) in sess_free_buffer().

Fix this by not calling memzero_explicit() on sess_data::iov[1] as
it's already by handled by callers.

Fixes: a4e430c8 ("cifs: replace kfree() with kfree_sensitive() for sensitive data")
Reviewed-by: default avatarEnzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: default avatarPaulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent a9e17d3d

fs/cifs/sess.c

+9 −7
Original line number Diff line number Diff line
@@ -1208,16 +1208,18 @@ sess_alloc_buffer(struct sess_data *sess_data, int wct) 
static void

sess_free_buffer(struct sess_data *sess_data)

{

	int i;

	struct kvec *iov = sess_data->iov;



	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */

	for (i = 0; i < 3; i++)

		if (sess_data->iov[i].iov_base)

			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);

	/*

	 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).

	 * Note that iov[1] is already freed by caller.

	 */

	if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)

		memzero_explicit(iov[0].iov_base, iov[0].iov_len);



	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);

	free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);

	sess_data->buf0_type = CIFS_NO_BUFFER;

	kfree(sess_data->iov[2].iov_base);

	kfree_sensitive(iov[2].iov_base);

}



static int