From: Chuck Lever <[email protected]>
The in_token->pages[] array is not NULL terminated. This results in
the following KASAN splat:
KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
Signed-off-by: Chuck Lever <[email protected]>
---
net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 96ab50eda9c2..73a90ad873fb 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1069,7 +1069,7 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
goto out_denied_free;
pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
- in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
+ in_token->pages = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);
if (!in_token->pages)
goto out_denied_free;
in_token->page_base = 0;
--
2.44.0
On 2 Jun 2024, at 18:15, [email protected] wrote:
> From: Chuck Lever <[email protected]>
>
> The in_token->pages[] array is not NULL terminated. This results in
> the following KASAN splat:
>
> KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
>
> Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
> Signed-off-by: Chuck Lever <[email protected]>
Nice.
Reviewed-by: Benjamin Coddington <[email protected]>
Ben
On Mon, Jun 03, 2024 at 08:33:51AM -0400, Benjamin Coddington wrote:
> On 2 Jun 2024, at 18:15, [email protected] wrote:
>
> > From: Chuck Lever <[email protected]>
> >
> > The in_token->pages[] array is not NULL terminated. This results in
> > the following KASAN splat:
> >
> > KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
> >
> > Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
> > Signed-off-by: Chuck Lever <[email protected]>
>
> Nice.
>
> Reviewed-by: Benjamin Coddington <[email protected]>
>
> Ben
>
Thank you, Ben. Applied to nfsd-fixes (for 6.10-rc).
--
Chuck Lever