2024-06-02 22:15:41

by Chuck Lever

Subject: [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages()

From: Chuck Lever <[email protected]>

The in_token->pages[] array is not NULL terminated. This results in
the following KASAN splat:

KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]

Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
Signed-off-by: Chuck Lever <[email protected]>
---
net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 96ab50eda9c2..73a90ad873fb 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1069,7 +1069,7 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
goto out_denied_free;

pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
- in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
+ in_token->pages = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);
if (!in_token->pages)
goto out_denied_free;
in_token->page_base = 0;
--
2.44.0

2024-06-03 12:34:05

by Benjamin Coddington

Subject: Re: [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages()

On 2 Jun 2024, at 18:15, [email protected] wrote:

> From: Chuck Lever <[email protected]>
>
> The in_token->pages[] array is not NULL terminated. This results in
> the following KASAN splat:
>
> KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
>
> Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
> Signed-off-by: Chuck Lever <[email protected]>

Nice.

Reviewed-by: Benjamin Coddington <[email protected]>

Ben

2024-06-03 13:14:29

by Chuck Lever III

Subject: Re: [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages()

On Mon, Jun 03, 2024 at 08:33:51AM -0400, Benjamin Coddington wrote:
> On 2 Jun 2024, at 18:15, [email protected] wrote:
>
> > From: Chuck Lever <[email protected]>
> >
> > The in_token->pages[] array is not NULL terminated. This results in
> > the following KASAN splat:
> >
> > KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
> >
> > Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
> > Signed-off-by: Chuck Lever <[email protected]>
>
> Nice.
>
> Reviewed-by: Benjamin Coddington <[email protected]>
>
> Ben
>

Thank you, Ben. Applied to nfsd-fixes (for 6.10-rc).

--
Chuck Lever