Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1157638
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.14 51/64] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures |
| Date | 2015-06-03 15:10 +0200 |
| Message-ID | <pxgAI-1Uo-57@gated-at.bofh.it> (permalink) |
| References | <pxfOh-E4-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <smayhew@redhat.com>
commit 9507271d960a1911a51683888837d75c171cd91f upstream.
In an environment where the KDC is running Active Directory, the
exported composite name field returned in the context could be large
enough to span a page boundary. Attaching a scratch buffer to the
decoding xdr_stream helps deal with those cases.
The case where we saw this was actually due to behavior that's been
fixed in newer gss-proxy versions, but we're fixing it here too.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_rpc_xdr.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -793,20 +793,26 @@ int gssx_dec_accept_sec_context(struct r
{
u32 value_follows;
int err;
+ struct page *scratch;
+
+ scratch = alloc_page(GFP_KERNEL);
+ if (!scratch)
+ return -ENOMEM;
+ xdr_set_scratch_buffer(xdr, page_address(scratch), PAGE_SIZE);
/* res->status */
err = gssx_dec_status(xdr, &res->status);
if (err)
- return err;
+ goto out_free;
/* res->context_handle */
err = gssx_dec_bool(xdr, &value_follows);
if (err)
- return err;
+ goto out_free;
if (value_follows) {
err = gssx_dec_ctx(xdr, res->context_handle);
if (err)
- return err;
+ goto out_free;
} else {
res->context_handle = NULL;
}
@@ -814,11 +820,11 @@ int gssx_dec_accept_sec_context(struct r
/* res->output_token */
err = gssx_dec_bool(xdr, &value_follows);
if (err)
- return err;
+ goto out_free;
if (value_follows) {
err = gssx_dec_buffer(xdr, res->output_token);
if (err)
- return err;
+ goto out_free;
} else {
res->output_token = NULL;
}
@@ -826,14 +832,17 @@ int gssx_dec_accept_sec_context(struct r
/* res->delegated_cred_handle */
err = gssx_dec_bool(xdr, &value_follows);
if (err)
- return err;
+ goto out_free;
if (value_follows) {
/* we do not support upcall servers sending this data. */
- return -EINVAL;
+ err = -EINVAL;
+ goto out_free;
}
/* res->options */
err = gssx_dec_option_array(xdr, &res->options);
+out_free:
+ __free_page(scratch);
return err;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.14 00/64] 3.14.44-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 31/64] USB: pl2303: Remove support for Samsung I330 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 03/64] staging: rtl8712, rtl8712: avoid lots of build warnings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 19/64] ALSA: hda - Add headphone quirk for Lifebook E752 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 58/64] sd: Disable support for 256 byte/sector disks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 29/64] xhci: gracefully handle xhci_irq dead device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 44/64] gpio: gpio-kempld: Fix get_direction return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 52/64] thermal: step_wise: Revert optimization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 08/64] net: socket: Fix the wrong returns for recvmsg and sendmsg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 56/64] Input: elantech - fix semi-mt protocol for v3 HW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 04/64] staging, rtl8192e, LLVMLinux: Remove unused inline prototype Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 40/64] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 14/64] hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 45/64] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 64/64] fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 41/64] libata: Add helper to determine when PHY events should be ignored Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 18/64] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200 [PATCH 3.14 32/64] USB: cp210x: add ID for KCF Technologies PRN device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 49/64] tools/vm: fix page-flags build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 53/64] md/raid5: dont record new size if resize_stripes fails. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 09/64] fs, omfs: add NULL terminator in the end up the token list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 23/64] ASoC: wm8960: fix "RINPUT3" audio route error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 50/64] mm, numa: really disable NUMA balancing by default on single node machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 37/64] tty/n_gsm.c: fix a memory leak when gsmtty is removed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 35/64] powerpc: Align TOC to 256 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 11/64] lguest: fix out-by-one error in address checking. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 51/64] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 12/64] libceph: request a new osdmap if lingering request maps to no osd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 07/64] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 10/64] xfs: xfs_iozero can return positive errno Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 54/64] md/raid0: fix restore to sector variable in raid0_make_request Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 [PATCH 3.14 55/64] rtlwifi: rtl8192cu: Fix kernel deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200 Re: [PATCH 3.14 00/64] 3.14.44-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-06-03 19:00 +0200
csiph-web