diff mbox series

rpc: fix NULL dereference on kmalloc failure

Message ID 20210302154838.GB2263@fieldses.org (mailing list archive)
State New
Headers show
Series rpc: fix NULL dereference on kmalloc failure | expand

Commit Message

bfields@fieldses.org March 2, 2021, 3:48 p.m. UTC
From: "J. Bruce Fields" <bfields@redhat.com>

I think this is unlikely but possible:

svc_authenticate sets rq_authop and calls svcauth_gss_accept.  The
kmalloc(sizeof(*svcdata), GFP_KERNEL) fails, leaving rq_auth_data NULL,
and returning SVC_DENIED.

This causes svc_process_common to go to err_bad_auth, and eventually
call svc_authorise.  That calls ->release == svcauth_gss_release, which
tries to dereference rq_auth_data.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

On Mon, Mar 01, 2021 at 11:28:20AM -0500, Bruce Fields wrote:
> Possibly orthogonal to this problem, but: svcauth_gss_release
> unconditionally dereferences rqstp->rq_auth_data.  Isn't that a NULL
> dereference if the kmalloc at the start of svcauth_gss_accept() fails?

Comments

Chuck Lever III March 3, 2021, 3:16 p.m. UTC | #1
Hi Bruce-

> On Mar 2, 2021, at 10:48 AM, Bruce Fields <bfields@fieldses.org> wrote:
> 
> From: "J. Bruce Fields" <bfields@redhat.com>
> 
> I think this is unlikely but possible:
> 
> svc_authenticate sets rq_authop and calls svcauth_gss_accept.  The
> kmalloc(sizeof(*svcdata), GFP_KERNEL) fails, leaving rq_auth_data NULL,
> and returning SVC_DENIED.
> 
> This causes svc_process_common to go to err_bad_auth, and eventually
> call svc_authorise.  That calls ->release == svcauth_gss_release, which
> tries to dereference rq_auth_data.
> 
> Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Thanks, now included in the for-rc topic branch at:

git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git

with the addition of a Link: tag to reference the extra text below.


> ---
> net/sunrpc/auth_gss/svcauth_gss.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
> 
> On Mon, Mar 01, 2021 at 11:28:20AM -0500, Bruce Fields wrote:
>> Possibly orthogonal to this problem, but: svcauth_gss_release
>> unconditionally dereferences rqstp->rq_auth_data.  Isn't that a NULL
>> dereference if the kmalloc at the start of svcauth_gss_accept() fails?
> 
> diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
> index bd4678db9d76..6dff64374bfe 100644
> --- a/net/sunrpc/auth_gss/svcauth_gss.c
> +++ b/net/sunrpc/auth_gss/svcauth_gss.c
> @@ -1825,11 +1825,14 @@ static int
> svcauth_gss_release(struct svc_rqst *rqstp)
> {
> 	struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
> -	struct rpc_gss_wire_cred *gc = &gsd->clcred;
> +	struct rpc_gss_wire_cred *gc;
> 	struct xdr_buf *resbuf = &rqstp->rq_res;
> 	int stat = -EINVAL;
> 	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
> 
> +	if (!gsd)
> +		goto out;
> +	gc = &gsd->clcred;
> 	if (gc->gc_proc != RPC_GSS_PROC_DATA)
> 		goto out;
> 	/* Release can be called twice, but we only wrap once. */
> @@ -1870,10 +1873,10 @@ svcauth_gss_release(struct svc_rqst *rqstp)
> 	if (rqstp->rq_cred.cr_group_info)
> 		put_group_info(rqstp->rq_cred.cr_group_info);
> 	rqstp->rq_cred.cr_group_info = NULL;
> -	if (gsd->rsci)
> +	if (gsd && gsd->rsci) {
> 		cache_put(&gsd->rsci->h, sn->rsc_cache);
> -	gsd->rsci = NULL;
> -
> +		gsd->rsci = NULL;
> +	}
> 	return stat;
> }
> 
> -- 
> 2.29.2
> 

--
Chuck Lever
diff mbox series

Patch

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index bd4678db9d76..6dff64374bfe 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1825,11 +1825,14 @@  static int
 svcauth_gss_release(struct svc_rqst *rqstp)
 {
 	struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
-	struct rpc_gss_wire_cred *gc = &gsd->clcred;
+	struct rpc_gss_wire_cred *gc;
 	struct xdr_buf *resbuf = &rqstp->rq_res;
 	int stat = -EINVAL;
 	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
+	if (!gsd)
+		goto out;
+	gc = &gsd->clcred;
 	if (gc->gc_proc != RPC_GSS_PROC_DATA)
 		goto out;
 	/* Release can be called twice, but we only wrap once. */
@@ -1870,10 +1873,10 @@  svcauth_gss_release(struct svc_rqst *rqstp)
 	if (rqstp->rq_cred.cr_group_info)
 		put_group_info(rqstp->rq_cred.cr_group_info);
 	rqstp->rq_cred.cr_group_info = NULL;
-	if (gsd->rsci)
+	if (gsd && gsd->rsci) {
 		cache_put(&gsd->rsci->h, sn->rsc_cache);
-	gsd->rsci = NULL;
-
+		gsd->rsci = NULL;
+	}
 	return stat;
 }