From 0cb81ed8b55b91f5358cb5dad7dd63dfa19178eb Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Wed, 12 Aug 2026 21:38:04 +0900 Subject: [PATCH] smb: server: Free sensitive data in connection.c with kfree_sensitive() struct ksmbd_conn contains an embedded struct ntlmssp_auth with the ciphertext[] and cryptkey[] arrays, so to avoid leaking this information via the heap, it should be freed with kfree_sensitive(). While we're at it, also use kfree_sensitive() for freeing preauth_info in ksmbd_conn_free() to avoid that the Preauth_HashValue[] could leak via the heap here, too. Signed-off-by: Thomas Huth Signed-off-by: Namjae Jeon --- fs/smb/server/connection.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c index dfbbded896d4..e225aca67686 100644 --- a/fs/smb/server/connection.c +++ b/fs/smb/server/connection.c @@ -190,7 +190,7 @@ static void __ksmbd_conn_release_work(struct work_struct *work) ida_destroy(&conn->async_ida); conn->transport->ops->free_transport(conn->transport); - kfree(conn); + kfree_sensitive(conn); } /** @@ -256,7 +256,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) */ xa_destroy(&conn->sessions); kvfree(conn->request_buf); - kfree(conn->preauth_info); + kfree_sensitive(conn->preauth_info); kfree(conn->mechToken); ksmbd_preauth_session_destroy(conn); ksmbd_conn_put(conn); @@ -794,7 +794,7 @@ again: if (atomic_dec_and_test(&target->refcnt)) { ida_destroy(&target->async_ida); t->ops->free_transport(t); - kfree(target); + kfree_sensitive(target); } goto again; }