ksmbd: refuse reauthentication of an expired session as another user

When a Kerberos session expires, its owner can reauthenticate it. For an
NTLM reauthentication, ntlm_authenticate() only compares the new user with
sess->user when the session is still valid. An expired session is in
SMB2_SESSION_IN_PROGRESS during the reauthentication, so it takes the
other branch and simply sets sess->user to the new user:

- the session's open files, tree connects and other state, created under
  the original user's identity, now belong to whichever user just
  authenticated, and a later Kerberos reauthentication is compared
  against that user rather than the original one;
- the original struct ksmbd_user is overwritten without being freed.

krb5_authenticate() already refuses a different user in this case, and
the valid-session branch of ntlm_authenticate() does too. Do the same for
an expired session: compare with the existing user and refuse a different
one with -EKEYREJECTED, freeing the newly looked-up user either way.

An AI assistant was used to find and fix this and as an independent
reviewer.

Fixes: a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets expire")
Cc: stable@vger.kernel.org
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

0 files changed, 0 insertions, 0 deletions