sunrpc: fix null pointer dereference on zero-length checksum

commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream.

In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes
checksum.data to be set to NULL. This triggers a NPD when accessing
checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that
the value of checksum.len is not less than XDR_UNIT.

Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream")
Cc: stable@kernel.org
Signed-off-by: Lei Lu <llfamsec@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 73a90ad873fb9da659ba76184b2e2a0e5324ce0d..2d5ac2b3d5269dec794a8ac28d608148d1e7af1c 100644 (file)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
                rqstp->rq_auth_stat = rpc_autherr_badverf;
                return SVC_DENIED;
        }
-       if (flavor != RPC_AUTH_GSS) {
+       if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) {
                rqstp->rq_auth_stat = rpc_autherr_badverf;
                return SVC_DENIED;
        }