smb: client: fix potential UAF in cifs_stats_proc_show()

Paulo Alcantara · smfrench · commit 0865ffefea19 · 2024-04-03T14:43:45.000-05:00
Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (Red Hat) &lt;pc@manguebit.com&gt;
Signed-off-by: Steve French &lt;stfrench@microsoft.com&gt;
diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
@@ -759,6 +759,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
 			}
 #endif /* STATS2 */
 		list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+			if (cifs_ses_exiting(ses))
+				continue;
 			list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 				i++;
 				seq_printf(m, "\n%d) %s", i, tcon->tree_name);

Original file line number	Diff line number	Diff line change
`@@ -759,6 +759,8 @@ static int cifs_stats_proc_show(struct seq_file m, void v)`
`759`	`759`	`}`
`760`	`760`	`#endif /* STATS2 */`
`761`	`761`	`list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {`
	`762`	`+ if (cifs_ses_exiting(ses))`
	`763`	`+ continue;`
`762`	`764`	`list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {`
`763`	`765`	`i++;`
`764`	`766`	`seq_printf(m, "\n%d) %s", i, tcon->tree_name);`