Re: [PATCH 3/4] smb: server: Free session data with kfree_sensitive() to avoid leaking of data

On Mon, Aug 10, 2026 at 9:59 PM Thomas Huth <[email protected]> wrote:
>
> From: Thomas Huth <[email protected]>
>
> struct ksmbd_session contains some arrays with sensitive information, like
> sess_key, smb3encryptionkey, smb3decryptionkey and smb3signingkey. Thus
> let's make sure that this information cannot leak via the heap and use
> kfree_sensitive() to free it.
>
> Signed-off-by: Thomas Huth <[email protected]>
> ---
>  fs/smb/server/mgmt/user_session.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
> index f99c86284ba3d..9cb990a22fd56 100644
> --- a/fs/smb/server/mgmt/user_session.c
> +++ b/fs/smb/server/mgmt/user_session.c
> @@ -389,10 +389,10 @@ void ksmbd_session_destroy(struct ksmbd_session *sess)
>         ksmbd_launch_ksmbd_durable_scavenger();
>         ksmbd_session_rpc_clear_list(sess);
>         free_channel_list(sess);
> -       kfree(sess->Preauth_HashValue);
> +       kfree_sensitive(sess->Preauth_HashValue);
>         ksmbd_release_id(&session_ida, sess->id);
>         ida_destroy(&sess->tree_conn_ida);
> -       kfree(sess);
> +       kfree_sensitive(sess);
struct preauth_session embeds the sensitive
Preauth_HashValue[PREAUTH_HASHVALUE_SIZE] field, but it is still
released with kfree() in ksmbd_preauth_session_destroy(). Please
include it in this patch or another patch...

Thanks!