]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
authorChuck Lever <chuck.lever@oracle.com>
Sun, 2 Jun 2024 22:15:25 +0000 (18:15 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 16 Jun 2024 11:39:53 +0000 (13:39 +0200)
commitb4878ea99f2b40ef1925720b1b4ca7f4af1ba785
tree63a66c63ea1bdc6a142d6241ff6adc64e90d0427
parenta896c674d512ff47e3005713442b2ddbdbfaaa9a
SUNRPC: Fix loop termination condition in gss_free_in_token_pages()

commit 4a77c3dead97339478c7422eb07bf4bf63577008 upstream.

The in_token->pages[] array is not NULL terminated. This results in
the following KASAN splat:

  KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]

Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sunrpc/auth_gss/svcauth_gss.c