[SRU][J][PATCH 1/1] smb: client: fix potential UAF in smb2_is_network_name_deleted()

[Tim Whisonant]

From: Paulo Alcantara <pc at manguebit.com>

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

Cc: stable at vger.kernel.org
Signed-off-by: Paulo Alcantara (Red Hat) <pc at manguebit.com>
Signed-off-by: Steve French <stfrench at microsoft.com>
(backported from commit 63981561ffd2d4987807df4126f96a11e18b0c1d)
[tswhison: context adjustment due to missing commit
9543c8ab301 ("cifs: list_for_each() -> list_for_each_entry()")]
CVE-2024-35862
Signed-off-by: Tim Whisonant <tim.whisonant at canonical.com>
---
 fs/cifs/smb2ops.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 1151a7cac552c..f4d0bff64d053 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -2560,6 +2560,8 @@ smb2_is_network_name_deleted(char *buf, struct TCP_Server_Info *server)
 	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each(tmp, &server->smb_ses_list) {
 		ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
+		if (cifs_ses_exiting(ses))
+			continue;
 		list_for_each(tmp1, &ses->tcon_list) {
 			tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
 			if (tcon->tid == shdr->TreeId) {
-- 
2.43.0