linux-nfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: NeilBrown <neilb@suse.de>
To: "J. Bruce Fields" <bfields@fieldses.org>,
	Chuck Lever <chuck.lever@oracle.com>,
	kircherlike@outlook.com,
	Stephen Hemminger <stephen@networkplumber.org>
Cc: linux-nfs@vger.kernel.org
Subject: [PATCH 0/3] SUNRPC/svc: fix gss flavour registration problems.
Date: Thu, 21 May 2020 13:21:41 +1000	[thread overview]
Message-ID: <159003086409.24897.4659128962844846611.stgit@noble> (raw)

As reported in
 https://bugzilla.kernel.org/show_bug.cgi?id=206651
there are problems with sunrpc/svc flavour registration.

This can be demonstrated as a memory-leak if you load the
rpcsec_gss_krb5 module, then unload the sunrpc module and all
dependents.  This action leaks 3 kmalloc-64 slab entires, and some
strings.

The possible consequences are worse.  If only unload rpcsec_gss_krb5
and reload just that, it will allow the old registered flavour handlers
to be used, and they will include pointers into memory which has since
been freed and possibly reused.  This can result in undesired
behaviour.

The first patch makes the leak apparent with a WARNing, the second
prevents it but also prevents module reload, the third removes the
incorrect behaviour so the module can be safely unloaded and reloaded.

I think all are suitable for -stable, but I haven't determined
appropriate 'Fixes:' tags.

NeilBrown

---

NeilBrown (3):
      sunrpc: check that domain table is empty at module unload.
      sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations.
      sunrpc: clean up properly in gss_mech_unregister()


 include/linux/sunrpc/gss_api.h        |    1 +
 include/linux/sunrpc/svcauth_gss.h    |    3 ++-
 net/sunrpc/auth_gss/gss_mech_switch.c |   12 +++++++++---
 net/sunrpc/auth_gss/svcauth_gss.c     |   17 ++++++++++-------
 net/sunrpc/sunrpc.h                   |    1 +
 net/sunrpc/sunrpc_syms.c              |    2 ++
 net/sunrpc/svcauth.c                  |   18 ++++++++++++++++++
 7 files changed, 43 insertions(+), 11 deletions(-)

--
Signature


             reply	other threads:[~2020-05-21  3:22 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-21  3:21 NeilBrown [this message]
2020-05-21  3:21 ` [PATCH 1/3] sunrpc: check that domain table is empty at module unload NeilBrown
2020-05-21  7:09   ` kbuild test robot
2020-05-21 12:39   ` kbuild test robot
2020-05-21 14:06   ` Chuck Lever
2020-05-21 23:44     ` NeilBrown
2020-05-22  0:33       ` Chuck Lever
2020-05-21  3:21 ` [PATCH 3/3] sunrpc: clean up properly in gss_mech_unregister() NeilBrown
2020-05-21  3:21 ` [PATCH 2/3] sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations NeilBrown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=159003086409.24897.4659128962844846611.stgit@noble \
    --to=neilb@suse.de \
    --cc=bfields@fieldses.org \
    --cc=chuck.lever@oracle.com \
    --cc=kircherlike@outlook.com \
    --cc=linux-nfs@vger.kernel.org \
    --cc=stephen@networkplumber.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).