]> git.ipfire.org Git - people/arne_f/kernel.git/commit
rpc: fix NULL dereference on kmalloc failure
authorJ. Bruce Fields <bfields@redhat.com>
Tue, 2 Mar 2021 15:48:38 +0000 (10:48 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 7 Apr 2021 10:47:00 +0000 (12:47 +0200)
commit863b8879a90b3cc668c13caeebf6a7e4850b739b
tree60dedbe504b3f38acab4be3785f931b8b1ae75fc
parentb3234384a256c8ac160cb0f5ae2c6528b9c32668
rpc: fix NULL dereference on kmalloc failure

[ Upstream commit 0ddc942394013f08992fc379ca04cffacbbe3dae ]

I think this is unlikely but possible:

svc_authenticate sets rq_authop and calls svcauth_gss_accept.  The
kmalloc(sizeof(*svcdata), GFP_KERNEL) fails, leaving rq_auth_data NULL,
and returning SVC_DENIED.

This causes svc_process_common to go to err_bad_auth, and eventually
call svc_authorise.  That calls ->release == svcauth_gss_release, which
tries to dereference rq_auth_data.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Link: https://lore.kernel.org/linux-nfs/3F1B347F-B809-478F-A1E9-0BE98E22B0F0@oracle.com/T/#t
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/sunrpc/auth_gss/svcauth_gss.c