Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Trond Myklebust <trondmy@hammerspace.com>,
        Anna Schumaker <anna.schumaker@netapp.com>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: [PATCH] SUNRPC: Fix crasher in gss_unwrap_resp_integ()
Thread-Topic: [PATCH] SUNRPC: Fix crasher in gss_unwrap_resp_integ()
Thread-Index: AQHY20gyNwrQP/Q5iU6k0KDZxQuYAa4V6zYA
Date:   Wed, 19 Oct 2022 15:38:52 +0000
Message-ID: <7AADFC73-5748-4D80-BED3-CF8D6A92D510@oracle.com>
References: <166525550985.1954655.13884581337321315995.stgit@morisot.1015granger.net>
In-Reply-To: <166525550985.1954655.13884581337321315995.stgit@morisot.1015granger.net>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?kBP6dFQITaXL6lYH5FnTYm9C2H7M2eH7n92kIUo10Y/SVy7QZVdMmtBCMa1I?=
 =?us-ascii?Q?F0q0t5xwC72zJMiDqsRzny3QMifr1FfOhKFMTNQycgTb4hRnRzPjD2nobFK9?=
 =?us-ascii?Q?Q7sqOqy2ix8C5ojQiguRVZnjxyUuMyNM426/cMZcGNMVDbHX/ZhquZAswuNN?=
 =?us-ascii?Q?rb/fm1dN90XL801OH4HsX37qjZdPy/aXiS8vFnGHgAjTd4Y3Mw/8x5+qi1LJ?=
 =?us-ascii?Q?0aKZsDGkt/9OCtk/K4RfLz+NRtiEMNHBPvoDqnsZFpgku3MaT/rQPTqkrogF?=
 =?us-ascii?Q?1lc4csjLEQIwZt9/Z23T8Sie8mF6piBJlgngw+GJpR5Xp4eoJZo5vymq9bwJ?=
 =?us-ascii?Q?8KDDVt3au7HrPVy+N/0EGCX38OD92jOAo0gpxf3P4lBBMI1Ef9vhzT72aI4M?=
 =?us-ascii?Q?sttCXZJ8wRbHcx46ffJCYWspmc7POqs6TE2OwycoFGfkpXe3j8lU1FgPp1hF?=
 =?us-ascii?Q?Xy8PsC1D20gIrPzwks04jnhfizNAkLj7th7SuvPi4qLBhOF+i3Ts1opTtkb+?=
 =?us-ascii?Q?6AiBy9YljSZwCjsHYoenJ41bRvKQznyFLtLI6Vo6JTATd9KYs95UuDIiqi++?=
 =?us-ascii?Q?rF5jaQxYDFC7zZJWGz7UZA6PYBq08T40V/QcXb1E7bX0TWcAJebydE15d58B?=
 =?us-ascii?Q?juAAEyM/cX837htuEv5cFy4t1Le2sq6qYAhEC062UTim4ha9zhHTKS2baFQc?=
 =?us-ascii?Q?hPan1jg8FZwco2qliOL8XNl2XNhvQcg7+DKDE+O8wR1ta7y1bfGyOkH6vS8Y?=
 =?us-ascii?Q?vQey9Wa+N+Z5ieVNGxelBePWJpoZMeoV3cLOw1WwHvnJNdNdEDZN+vP/0w5L?=
 =?us-ascii?Q?v/tTICojDwBI9olgIuD2EjUW59aFcZxi/Zc+qgoeIw+97bdjGLFtVc0S9DOF?=
 =?us-ascii?Q?HU5dHPU8aEUjRvD3dYf44HeQ39eD8/vE73brpUDB79YX0V4MXOdhs2VXZGiy?=
 =?us-ascii?Q?VK+Q2zz9eJ5ZeGsPWj3X9V3vyzD0xmMBxzYVnTE7rcxr3N2PcBVpg7ZOcjMN?=
 =?us-ascii?Q?ATOE0ir9SG2kwZF9HpdHGSySpElzz7dDohSwMRApBlO/VGipbI+olzRJMl1m?=
 =?us-ascii?Q?c29seFV/J5+Q3PI0Bc0NXnUzOiQJLKMRv23I4sF8+LHZICa5+1Mj9ZTXTVxW?=
 =?us-ascii?Q?B8WxS4vENGHeMqAeYb0w+K8CM2D/1u5NB5Prbm0duwJgb4Ymq88URMfDMewz?=
 =?us-ascii?Q?jprm43oTiqIidilf2tPdaZEIN0rtywLfqEeKPsuDHiBzDciLhmdSCkc8z104?=
 =?us-ascii?Q?mFub3R0f7x6feTJpCzMWB2LdcJ1hqFkX//JuofjDgph23YlgdGUbINJw51OE?=
 =?us-ascii?Q?JJfMfBKHR0BEthkImE3GbTgR6lEzueVGWJIq1I8RAxraQ8SsQayb7lMvzQfD?=
 =?us-ascii?Q?0aO26m3k9dBEV+89+L8Oj6Vp/PIhqs0M4EWf7pbOnl4q7y+geZuNCFFRzxr6?=
 =?us-ascii?Q?LHi1pKF4v/2eO3ExuUjtSdH32zzcDOetxiNmKzwEE12qlOVaMzkgSnuQ1xQy?=
 =?us-ascii?Q?i1jn0WNLMwdlxF8wCOlcRfE5xsG0ZEM1YGHuAxOMNuT1Cl35v0Qx12XWSePV?=
 =?us-ascii?Q?zA/so/xDyV1XOwa1wZAm6SbHzPAoo2lTFP1uhvL5fIqfIHG3iQgr/ecFhg0E?=
 =?us-ascii?Q?Zg=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <687E5449867A5D4395A194A2D4D30D84@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b08d8c7d-c361-4c2b-b18a-08dab1e80691
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Oct 2022 15:38:52.6774
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: iYjojmB6utpGR3gEqXWlNjo+m2Q6+nnHYdVoXxsFkg3IozRZ1Es854l8CVFGEDUE4PmW5hb2XEIxczJTimm55w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR10MB6905
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-10-19_09,2022-10-19_04,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 mlxscore=0
 suspectscore=0 mlxlogscore=999 phishscore=0 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2210190088
X-Proofpoint-ORIG-GUID: gtmuC25iwLQO2XZ07gFWT7XBtgOldhvq
X-Proofpoint-GUID: gtmuC25iwLQO2XZ07gFWT7XBtgOldhvq
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Oct 8, 2022, at 2:58 PM, Chuck Lever <chuck.lever@oracle.com> wrote:
>=20
> If a zero length is passed to kmalloc() it returns 0x10, which is
> not a valid address. gss_unwrap_resp_integ() subsequently crashes
> when it attempts to dereference that pointer.
>=20
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

Hi, is there a plan to merge this patch, or does the fix need
a different approach?


> ---
> net/sunrpc/auth_gss/auth_gss.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>=20
> diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gs=
s.c
> index a31a27816cc0..7bb247c51e2f 100644
> --- a/net/sunrpc/auth_gss/auth_gss.c
> +++ b/net/sunrpc/auth_gss/auth_gss.c
> @@ -1989,7 +1989,7 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct=
 rpc_cred *cred,
> 		goto unwrap_failed;
> 	mic.len =3D len;
> 	mic.data =3D kmalloc(len, GFP_KERNEL);
> -	if (!mic.data)
> +	if (ZERO_OR_NULL_PTR(mic.data))
> 		goto unwrap_failed;
> 	if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
> 		goto unwrap_failed;
>=20
>=20

--
Chuck Lever