Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
Date:   Wed, 08 Jun 2022 16:59:28 +0000
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8BIT
From:   marcel@linux-ng.de
Message-ID: <fc9862d27cdf732e305bc6d1800bdf2a@linux-ng.de>
Subject: Re: [PATCH 1/3] cifs-utils/svcgssd: Fix use-after-free bug
 (config variables)
To:     linux-nfs@vger.kernel.org
In-Reply-To: <20220607081909.1216287-1-marcel@linux-ng.de>
References: <20220607081909.1216287-1-marcel@linux-ng.de>
Precedence: bulk

Hi again,

argl - just noticed that I described the patches with "cifs-utils" - should be "nfs-utils" of course :-(
Sorry for that.

Marcel


June 7, 2022 10:19 AM, marcel@linux-ng.de wrote:

> From: Marcel Ritter <marcel@linux-ng.de>
> 
> This patch fixes a bug when trying to set "principal" in /etc/nfs.conf.
> Memory gets freed by conf_cleanup() before being used - moving cleanup
> code resolves that.
> 
> ---
> utils/gssd/svcgssd.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/utils/gssd/svcgssd.c b/utils/gssd/svcgssd.c
> index 881207b3..a242b789 100644
> --- a/utils/gssd/svcgssd.c
> +++ b/utils/gssd/svcgssd.c
> @@ -211,9 +211,6 @@ main(int argc, char *argv[])
> rpc_verbosity = conf_get_num("svcgssd", "RPC-Verbosity", rpc_verbosity);
> idmap_verbosity = conf_get_num("svcgssd", "IDMAP-Verbosity", idmap_verbosity);
> 
> - /* We don't need the config anymore */
> - conf_cleanup();
> -
> while ((opt = getopt(argc, argv, "fivrnp:")) != -1) {
> switch (opt) {
> case 'f':
> @@ -328,6 +325,9 @@ main(int argc, char *argv[])
> 
> daemon_ready();
> 
> + /* We don't need the config anymore */
> + conf_cleanup();
> +
> nfs4_init_name_mapping(NULL); /* XXX: should only do this once */
> 
> rc = event_base_dispatch(evbase);
> -- 
> 2.34.1