* [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
@ 2024-06-02 22:15 cel
2024-06-03 12:33 ` Benjamin Coddington
0 siblings, 1 reply; 3+ messages in thread
From: cel @ 2024-06-02 22:15 UTC (permalink / raw)
To: linux-nfs; +Cc: Chuck Lever
From: Chuck Lever <chuck.lever@oracle.com>
The in_token->pages[] array is not NULL terminated. This results in
the following KASAN splat:
KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 96ab50eda9c2..73a90ad873fb 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1069,7 +1069,7 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
goto out_denied_free;
pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
- in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
+ in_token->pages = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);
if (!in_token->pages)
goto out_denied_free;
in_token->page_base = 0;
--
2.44.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
2024-06-02 22:15 [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages() cel
@ 2024-06-03 12:33 ` Benjamin Coddington
2024-06-03 13:10 ` Chuck Lever
0 siblings, 1 reply; 3+ messages in thread
From: Benjamin Coddington @ 2024-06-03 12:33 UTC (permalink / raw)
To: cel; +Cc: linux-nfs, Chuck Lever
On 2 Jun 2024, at 18:15, cel@kernel.org wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
>
> The in_token->pages[] array is not NULL terminated. This results in
> the following KASAN splat:
>
> KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
>
> Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Nice.
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Ben
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
2024-06-03 12:33 ` Benjamin Coddington
@ 2024-06-03 13:10 ` Chuck Lever
0 siblings, 0 replies; 3+ messages in thread
From: Chuck Lever @ 2024-06-03 13:10 UTC (permalink / raw)
To: Benjamin Coddington; +Cc: cel, linux-nfs
On Mon, Jun 03, 2024 at 08:33:51AM -0400, Benjamin Coddington wrote:
> On 2 Jun 2024, at 18:15, cel@kernel.org wrote:
>
> > From: Chuck Lever <chuck.lever@oracle.com>
> >
> > The in_token->pages[] array is not NULL terminated. This results in
> > the following KASAN splat:
> >
> > KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
> >
> > Fixes: bafa6b4d95d9 ("SUNRPC: Fix gss_free_in_token_pages()")
> > Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
>
> Nice.
>
> Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
>
> Ben
>
Thank you, Ben. Applied to nfsd-fixes (for 6.10-rc).
--
Chuck Lever
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-06-03 13:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-02 22:15 [PATCH] SUNRPC: Fix loop termination condition in gss_free_in_token_pages() cel
2024-06-03 12:33 ` Benjamin Coddington
2024-06-03 13:10 ` Chuck Lever
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.