From: Chuck Lever <chuck.lever@oracle.com>
To: Bruce Fields <bfields@fieldses.org>
Cc: Daniel Kobras <kobras@puzzle-itc.de>,
Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: [PATCH] rpc: fix NULL dereference on kmalloc failure
Date: Wed, 3 Mar 2021 15:16:38 +0000 [thread overview]
Message-ID: <598D1A69-B5BF-4F77-91EE-C9C0344530D3@oracle.com> (raw)
In-Reply-To: <20210302154838.GB2263@fieldses.org>
Hi Bruce-
> On Mar 2, 2021, at 10:48 AM, Bruce Fields <bfields@fieldses.org> wrote:
>
> From: "J. Bruce Fields" <bfields@redhat.com>
>
> I think this is unlikely but possible:
>
> svc_authenticate sets rq_authop and calls svcauth_gss_accept. The
> kmalloc(sizeof(*svcdata), GFP_KERNEL) fails, leaving rq_auth_data NULL,
> and returning SVC_DENIED.
>
> This causes svc_process_common to go to err_bad_auth, and eventually
> call svc_authorise. That calls ->release == svcauth_gss_release, which
> tries to dereference rq_auth_data.
>
> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Thanks, now included in the for-rc topic branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git
with the addition of a Link: tag to reference the extra text below.
> ---
> net/sunrpc/auth_gss/svcauth_gss.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
> On Mon, Mar 01, 2021 at 11:28:20AM -0500, Bruce Fields wrote:
>> Possibly orthogonal to this problem, but: svcauth_gss_release
>> unconditionally dereferences rqstp->rq_auth_data. Isn't that a NULL
>> dereference if the kmalloc at the start of svcauth_gss_accept() fails?
>
> diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
> index bd4678db9d76..6dff64374bfe 100644
> --- a/net/sunrpc/auth_gss/svcauth_gss.c
> +++ b/net/sunrpc/auth_gss/svcauth_gss.c
> @@ -1825,11 +1825,14 @@ static int
> svcauth_gss_release(struct svc_rqst *rqstp)
> {
> struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
> - struct rpc_gss_wire_cred *gc = &gsd->clcred;
> + struct rpc_gss_wire_cred *gc;
> struct xdr_buf *resbuf = &rqstp->rq_res;
> int stat = -EINVAL;
> struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
>
> + if (!gsd)
> + goto out;
> + gc = &gsd->clcred;
> if (gc->gc_proc != RPC_GSS_PROC_DATA)
> goto out;
> /* Release can be called twice, but we only wrap once. */
> @@ -1870,10 +1873,10 @@ svcauth_gss_release(struct svc_rqst *rqstp)
> if (rqstp->rq_cred.cr_group_info)
> put_group_info(rqstp->rq_cred.cr_group_info);
> rqstp->rq_cred.cr_group_info = NULL;
> - if (gsd->rsci)
> + if (gsd && gsd->rsci) {
> cache_put(&gsd->rsci->h, sn->rsc_cache);
> - gsd->rsci = NULL;
> -
> + gsd->rsci = NULL;
> + }
> return stat;
> }
>
> --
> 2.29.2
>
--
Chuck Lever
prev parent reply other threads:[~2021-03-04 0:29 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-26 23:04 [PATCH] sunrpc: fix refcount leak for rpc auth modules Daniel Kobras
2021-03-01 15:20 ` Chuck Lever
2021-03-01 16:28 ` Bruce Fields
2021-03-01 17:44 ` Chuck Lever
2021-03-01 18:15 ` Bruce Fields
2021-03-01 18:21 ` Chuck Lever
2021-03-02 11:50 ` Daniel Kobras
2021-03-02 15:48 ` Chuck Lever
2021-03-02 15:48 ` [PATCH] rpc: fix NULL dereference on kmalloc failure Bruce Fields
2021-03-03 15:16 ` Chuck Lever [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=598D1A69-B5BF-4F77-91EE-C9C0344530D3@oracle.com \
--to=chuck.lever@oracle.com \
--cc=bfields@fieldses.org \
--cc=kobras@puzzle-itc.de \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).