[PATCH] auth_domain_lookup in 2.6.8-rc2

[Olaf Kirch <okir@suse.de>]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

Hi,

2.6.8-rc2 open-codes auth_domain_lookup, and introduces a flaw that
may have security consequences. If we do not find any matching
domain, the routine always returns the last item looked at, no
matter what it was.

Olaf
-- 
Olaf Kirch     | Things that make Monday morning interesting, #1:
okir@suse.de   |        "I want to use NFS over AX25, can you help me?"
---------------+ 

[-- Attachment #2: sunrpc-authdomain-lookup --]
[-- Type: text/plain, Size: 829 bytes --]


This patch makes sure that auth_domain_lookup returns NULL when
it doesn't find a matching entry, rather than the last entry
in the hash chain.

Signed-off-by: Olaf Kirch <okir@suse.de>

Index: linux-2.6.8/net/sunrpc/svcauth.c
===================================================================
--- linux-2.6.8.orig/net/sunrpc/svcauth.c
+++ linux-2.6.8/net/sunrpc/svcauth.c
@@ -183,7 +183,7 @@ auth_domain_lookup(struct auth_domain *i
 	}
 	/* Didn't find anything */
 	if (!set)
-		goto out_noset;
+		goto out_nada;
 	auth_domain_cache.entries++;
 out_set:
 	set_bit(CACHE_HASHED, &item->h.flags);
@@ -193,6 +193,8 @@ out_set:
 	cache_fresh(&auth_domain_cache, &item->h, item->h.expiry_time);
 	cache_get(&item->h);
 	return item;
+out_nada:
+	tmp = NULL;
 out_noset:
 	read_unlock(&auth_domain_cache.hash_lock);
 	return tmp;