Re: [PATCH 1/4] smb: server: Clear sensitive stack and heap data in auth.c

Next message: Boris Brezillon: "[PATCH v2 12/17] drm/panthor: Make the VM cleanup path more robust against UAF"
Previous message: Boris Brezillon: "[PATCH v2 14/17] drm/panthor: Track user owned groups"
In reply to: Thomas Huth: "[PATCH 1/4] smb: server: Clear sensitive stack and heap data in auth.c"
Next in thread: Thomas Huth: "[PATCH 4/4] smb: server: Free sensitive connection data with kfree_sensitive()"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

From: Namjae Jeon

Date: Tue Aug 11 2026 - 06:22:46 EST

> @@ -464,7 +466,7 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
> *out_len = resp->spnego_blob_len;
> retval = 0;
> out:
> - kvfree(resp);
> + kvfree_sensitive(resp, sizeof(*resp));
The flexible payload[] array contains the session key and AP-REP data,
which would remain in memory after the free. Please clear the complete
allocation:

kvfree_sensitive(resp, sizeof(*resp) + resp->session_key_len
+ resp->spnego_blob_len);

Thanks!