Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1157638

[PATCH 3.14 51/64] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.14 51/64] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures
Date 2015-06-03 15:10 +0200
Message-ID <pxgAI-1Uo-57@gated-at.bofh.it> (permalink)
References <pxfOh-E4-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Scott Mayhew <smayhew@redhat.com>

commit 9507271d960a1911a51683888837d75c171cd91f upstream.

In an environment where the KDC is running Active Directory, the
exported composite name field returned in the context could be large
enough to span a page boundary.  Attaching a scratch buffer to the
decoding xdr_stream helps deal with those cases.

The case where we saw this was actually due to behavior that's been
fixed in newer gss-proxy versions, but we're fixing it here too.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/auth_gss/gss_rpc_xdr.c |   23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -793,20 +793,26 @@ int gssx_dec_accept_sec_context(struct r
 {
 	u32 value_follows;
 	int err;
+	struct page *scratch;
+
+	scratch = alloc_page(GFP_KERNEL);
+	if (!scratch)
+		return -ENOMEM;
+	xdr_set_scratch_buffer(xdr, page_address(scratch), PAGE_SIZE);
 
 	/* res->status */
 	err = gssx_dec_status(xdr, &res->status);
 	if (err)
-		return err;
+		goto out_free;
 
 	/* res->context_handle */
 	err = gssx_dec_bool(xdr, &value_follows);
 	if (err)
-		return err;
+		goto out_free;
 	if (value_follows) {
 		err = gssx_dec_ctx(xdr, res->context_handle);
 		if (err)
-			return err;
+			goto out_free;
 	} else {
 		res->context_handle = NULL;
 	}
@@ -814,11 +820,11 @@ int gssx_dec_accept_sec_context(struct r
 	/* res->output_token */
 	err = gssx_dec_bool(xdr, &value_follows);
 	if (err)
-		return err;
+		goto out_free;
 	if (value_follows) {
 		err = gssx_dec_buffer(xdr, res->output_token);
 		if (err)
-			return err;
+			goto out_free;
 	} else {
 		res->output_token = NULL;
 	}
@@ -826,14 +832,17 @@ int gssx_dec_accept_sec_context(struct r
 	/* res->delegated_cred_handle */
 	err = gssx_dec_bool(xdr, &value_follows);
 	if (err)
-		return err;
+		goto out_free;
 	if (value_follows) {
 		/* we do not support upcall servers sending this data. */
-		return -EINVAL;
+		err = -EINVAL;
+		goto out_free;
 	}
 
 	/* res->options */
 	err = gssx_dec_option_array(xdr, &res->options);
 
+out_free:
+	__free_page(scratch);
 	return err;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 3.14 00/64] 3.14.44-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 31/64] USB: pl2303: Remove support for Samsung I330 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 03/64] staging: rtl8712, rtl8712: avoid lots of build warnings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 19/64] ALSA: hda - Add headphone quirk for Lifebook E752 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 58/64] sd: Disable support for 256 byte/sector disks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 29/64] xhci: gracefully handle xhci_irq dead device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 44/64] gpio: gpio-kempld: Fix get_direction return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 52/64] thermal: step_wise: Revert optimization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 08/64] net: socket: Fix the wrong returns for recvmsg and sendmsg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 56/64] Input: elantech - fix semi-mt protocol for v3 HW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 04/64] staging, rtl8192e, LLVMLinux: Remove unused inline prototype Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 40/64] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 14/64] hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 45/64] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 64/64] fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 41/64] libata: Add helper to determine when PHY events should be ignored Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 18/64] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 32/64] USB: cp210x: add ID for KCF Technologies PRN device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 49/64] tools/vm: fix page-flags build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 53/64] md/raid5: dont record new size if resize_stripes fails. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 09/64] fs, omfs: add NULL terminator in the end up the token list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 23/64] ASoC: wm8960: fix "RINPUT3" audio route error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 50/64] mm, numa: really disable NUMA balancing by default on single node machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 37/64] tty/n_gsm.c: fix a memory leak when gsmtty is removed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 35/64] powerpc: Align TOC to 256 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 11/64] lguest: fix out-by-one error in address checking. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 51/64] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 12/64] libceph: request a new osdmap if lingering request maps to no osd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 07/64] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 10/64] xfs: xfs_iozero can return positive errno Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 54/64] md/raid0: fix restore to sector variable in raid0_make_request Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 55/64] rtlwifi: rtl8192cu: Fix kernel deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  Re: [PATCH 3.14 00/64] 3.14.44-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-06-03 19:00 +0200

csiph-web