Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chuck Lever <chuck.lever@oracle.com>
To:     Bruce Fields <bfields@fieldses.org>
CC:     Daniel Kobras <kobras@puzzle-itc.de>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: [PATCH] rpc: fix NULL dereference on kmalloc failure
Thread-Topic: [PATCH] rpc: fix NULL dereference on kmalloc failure
Thread-Index: AQHXD3uGhYxnELw7z0+r35pAs8NkU6pyYXGA
Date:   Wed, 3 Mar 2021 15:16:38 +0000
Message-ID: <598D1A69-B5BF-4F77-91EE-C9C0344530D3@oracle.com>
References: <20210226230437.jfgagcq5magzlrtv@tuedko18.puzzle-itc.de>
 <C2704113-2581-4B58-806B-BB65148AC14B@oracle.com>
 <20210301162820.GB11772@fieldses.org> <20210302154838.GB2263@fieldses.org>
In-Reply-To: <20210302154838.GB2263@fieldses.org>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <E3BDF1001F2A3E4BBAD409A3037EF279@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 09743c99-75f6-4264-5a34-08d8de57578e
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Mar 2021 15:16:38.4666
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 6tPNGqFhH1PenzhpQh7JGbHvzX1D+kSylCDviZuHsthYQpZUrqMSYGc4WibCk9nl132hwMGncvM551zDn1nSaw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4429
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9912 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxscore=0 phishscore=0
 malwarescore=0 spamscore=0 mlxlogscore=952 suspectscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000
 definitions=main-2103030118
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9912 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 lowpriorityscore=0 clxscore=1015
 priorityscore=1501 mlxlogscore=999 suspectscore=0 malwarescore=0
 impostorscore=0 bulkscore=0 adultscore=0 mlxscore=0 phishscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2009150000 definitions=main-2103030118
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org

Hi Bruce-

> On Mar 2, 2021, at 10:48 AM, Bruce Fields <bfields@fieldses.org> wrote:
>=20
> From: "J. Bruce Fields" <bfields@redhat.com>
>=20
> I think this is unlikely but possible:
>=20
> svc_authenticate sets rq_authop and calls svcauth_gss_accept.  The
> kmalloc(sizeof(*svcdata), GFP_KERNEL) fails, leaving rq_auth_data NULL,
> and returning SVC_DENIED.
>=20
> This causes svc_process_common to go to err_bad_auth, and eventually
> call svc_authorise.  That calls ->release =3D=3D svcauth_gss_release, whi=
ch
> tries to dereference rq_auth_data.
>=20
> Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Thanks, now included in the for-rc topic branch at:

git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git

with the addition of a Link: tag to reference the extra text below.


> ---
> net/sunrpc/auth_gss/svcauth_gss.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>=20
> On Mon, Mar 01, 2021 at 11:28:20AM -0500, Bruce Fields wrote:
>> Possibly orthogonal to this problem, but: svcauth_gss_release
>> unconditionally dereferences rqstp->rq_auth_data.  Isn't that a NULL
>> dereference if the kmalloc at the start of svcauth_gss_accept() fails?
>=20
> diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svca=
uth_gss.c
> index bd4678db9d76..6dff64374bfe 100644
> --- a/net/sunrpc/auth_gss/svcauth_gss.c
> +++ b/net/sunrpc/auth_gss/svcauth_gss.c
> @@ -1825,11 +1825,14 @@ static int
> svcauth_gss_release(struct svc_rqst *rqstp)
> {
> 	struct gss_svc_data *gsd =3D (struct gss_svc_data *)rqstp->rq_auth_data;
> -	struct rpc_gss_wire_cred *gc =3D &gsd->clcred;
> +	struct rpc_gss_wire_cred *gc;
> 	struct xdr_buf *resbuf =3D &rqstp->rq_res;
> 	int stat =3D -EINVAL;
> 	struct sunrpc_net *sn =3D net_generic(SVC_NET(rqstp), sunrpc_net_id);
>=20
> +	if (!gsd)
> +		goto out;
> +	gc =3D &gsd->clcred;
> 	if (gc->gc_proc !=3D RPC_GSS_PROC_DATA)
> 		goto out;
> 	/* Release can be called twice, but we only wrap once. */
> @@ -1870,10 +1873,10 @@ svcauth_gss_release(struct svc_rqst *rqstp)
> 	if (rqstp->rq_cred.cr_group_info)
> 		put_group_info(rqstp->rq_cred.cr_group_info);
> 	rqstp->rq_cred.cr_group_info =3D NULL;
> -	if (gsd->rsci)
> +	if (gsd && gsd->rsci) {
> 		cache_put(&gsd->rsci->h, sn->rsc_cache);
> -	gsd->rsci =3D NULL;
> -
> +		gsd->rsci =3D NULL;
> +	}
> 	return stat;
> }
>=20
> --=20
> 2.29.2
>=20

--
Chuck Lever