From: Paulo Alcantara <pc@cjr.nz>
Date: Tue, 10 Jan 2023 20:35:46 -0300
Subject: [PATCH] cifs: fix potential memory leaks in session setup
Git-commit: 2fe58d977ee05da5bb89ef5dc4f5bf2dc15db46f
References: bsc#1190317
Patch-mainline: v6.2-rc4

Make sure to free cifs_ses::auth_key.response before allocating it as
we might end up leaking memory in reconnect or mounting.

Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Acked-by: Enzo Matsumiya <ematsumiya@suse.de>
---
 fs/cifs/cifsencrypt.c |    1 +
 fs/cifs/sess.c        |    2 ++
 fs/cifs/smb2pdu.c     |    1 +
 3 files changed, 4 insertions(+)

--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -367,6 +367,7 @@ build_avpair_blob(struct cifs_ses *ses,
 	 * ( for NTLMSSP_AV_NB_DOMAIN_NAME followed by NTLMSSP_AV_EOL ) +
 	 * unicode length of a netbios domain name
 	 */
+	kfree(ses->auth_key.response);
 	ses->auth_key.len = size + 2 * dlen;
 	ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL);
 	if (!ses->auth_key.response) {
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -343,6 +343,7 @@ int decode_ntlmssp_challenge(char *bcc_p
 		return -EINVAL;
 	}
 	if (tilen) {
+		kfree(ses->auth_key.response);
 		ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
 						 GFP_KERNEL);
 		if (!ses->auth_key.response) {
@@ -1078,6 +1079,7 @@ sess_auth_kerberos(struct sess_data *ses
 		goto out_put_spnego_key;
 	}
 
+	kfree(ses->auth_key.response);
 	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
 					 GFP_KERNEL);
 	if (!ses->auth_key.response) {
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1298,6 +1298,7 @@ SMB2_auth_kerberos(struct SMB2_sess_data
 		goto out_put_spnego_key;
 	}
 
+	kfree(ses->auth_key.response);
 	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
 					 GFP_KERNEL);
 	if (!ses->auth_key.response) {