ksmbd: fix null pointer dereference in destroy_previous_session
authorNamjae Jeon <linkinjeon@kernel.org>
Fri, 13 Jun 2025 01:12:43 +0000 (10:12 +0900)
committerSteve French <stfrench@microsoft.com>
Tue, 17 Jun 2025 21:27:15 +0000 (16:27 -0500)
commit7ac5b66acafcc9292fb935d7e03790f2b8b2dc0e
tree1c547e40aba9d3d381c836c8892117e125730f83
parenta89f5fae998bdc4d0505306f93844c9ae059d50c
ksmbd: fix null pointer dereference in destroy_previous_session

If client set ->PreviousSessionId on kerberos session setup stage,
NULL pointer dereference error will happen. Since sess->user is not
set yet, It can pass the user argument as NULL to destroy_previous_session.
sess->user will be set in ksmbd_krb5_authenticate(). So this patch move
calling destroy_previous_session() after ksmbd_krb5_authenticate().

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27391
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/smb2pdu.c