From: Joshua Rogers Date: Wed, 31 Dec 2025 14:43:03 +0000 (-0500) Subject: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf X-Git-Tag: v5.10.248~81 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a8f1e445ce3545c90d69c9e8ff8f7821825fe810;p=thirdparty%2Fkernel%2Fstable.git SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf [ Upstream commit d4b69a6186b215d2dc1ebcab965ed88e8d41768d ] A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0. Fixes: 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()") Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Signed-off-by: Chuck Lever [ adapted xdr buffer pointer API to older argv iov_base/iov_len API ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index 329eac782cc5e..fe85762dbd966 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -1177,7 +1177,8 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp, } length = min_t(unsigned int, inlen, argv->iov_len); - memcpy(page_address(in_token->pages[0]), argv->iov_base, length); + if (length) + memcpy(page_address(in_token->pages[0]), argv->iov_base, length); inlen -= length; to_offs = length;