ksmbd: fix use-after-free in ksmbd_sessions_deregister()
commit 15a9605f upstream. In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel. session that is freed through the global session table can be accessed again through ->sessions of connection. Cc: stable@vger.kernel.org Reported-by:Norbert Szetei <norbert@doyensec.com> Tested-by:
Norbert Szetei <norbert@doyensec.com> Signed-off-by:
Namjae Jeon <linkinjeon@kernel.org> Signed-off-by:
Steve French <stfrench@microsoft.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Loading