From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Laura Abbott <labbott@redhat.com>,
"J. Bruce Fields" <bfields@redhat.com>,
Sasha Levin <alexander.levin@microsoft.com>
Subject: [PATCH 4.9 19/78] sunrpc: Dont use stack buffer with scatterlist
Date: Thu, 13 Sep 2018 15:31:06 +0200 [thread overview]
Message-ID: <20180913131806.988428353@linuxfoundation.org> (raw)
In-Reply-To: <20180913131805.732342940@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <labbott@redhat.com>
[ Upstream commit 44090cc876926277329e1608bafc01b9f6da627f ]
Fedora got a bug report from NFS:
kernel BUG at include/linux/scatterlist.h:143!
...
RIP: 0010:sg_init_one+0x7d/0x90
..
make_checksum+0x4e7/0x760 [rpcsec_gss_krb5]
gss_get_mic_kerberos+0x26e/0x310 [rpcsec_gss_krb5]
gss_marshal+0x126/0x1a0 [auth_rpcgss]
? __local_bh_enable_ip+0x80/0xe0
? call_transmit_status+0x1d0/0x1d0 [sunrpc]
call_transmit+0x137/0x230 [sunrpc]
__rpc_execute+0x9b/0x490 [sunrpc]
rpc_run_task+0x119/0x150 [sunrpc]
nfs4_run_exchange_id+0x1bd/0x250 [nfsv4]
_nfs4_proc_exchange_id+0x2d/0x490 [nfsv4]
nfs41_discover_server_trunking+0x1c/0xa0 [nfsv4]
nfs4_discover_server_trunking+0x80/0x270 [nfsv4]
nfs4_init_client+0x16e/0x240 [nfsv4]
? nfs_get_client+0x4c9/0x5d0 [nfs]
? _raw_spin_unlock+0x24/0x30
? nfs_get_client+0x4c9/0x5d0 [nfs]
nfs4_set_client+0xb2/0x100 [nfsv4]
nfs4_create_server+0xff/0x290 [nfsv4]
nfs4_remote_mount+0x28/0x50 [nfsv4]
mount_fs+0x3b/0x16a
vfs_kern_mount.part.35+0x54/0x160
nfs_do_root_mount+0x7f/0xc0 [nfsv4]
nfs4_try_mount+0x43/0x70 [nfsv4]
? get_nfs_version+0x21/0x80 [nfs]
nfs_fs_mount+0x789/0xbf0 [nfs]
? pcpu_alloc+0x6ca/0x7e0
? nfs_clone_super+0x70/0x70 [nfs]
? nfs_parse_mount_options+0xb40/0xb40 [nfs]
mount_fs+0x3b/0x16a
vfs_kern_mount.part.35+0x54/0x160
do_mount+0x1fd/0xd50
ksys_mount+0xba/0xd0
__x64_sys_mount+0x21/0x30
do_syscall_64+0x60/0x1f0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
This is BUG_ON(!virt_addr_valid(buf)) triggered by using a stack
allocated buffer with a scatterlist. Convert the buffer for
rc4salt to be dynamically allocated instead.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1615258
Signed-off-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_krb5_crypto.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -169,7 +169,7 @@ make_checksum_hmac_md5(struct krb5_ctx *
struct scatterlist sg[1];
int err = -1;
u8 *checksumdata;
- u8 rc4salt[4];
+ u8 *rc4salt;
struct crypto_ahash *md5;
struct crypto_ahash *hmac_md5;
struct ahash_request *req;
@@ -183,14 +183,18 @@ make_checksum_hmac_md5(struct krb5_ctx *
return GSS_S_FAILURE;
}
+ rc4salt = kmalloc_array(4, sizeof(*rc4salt), GFP_NOFS);
+ if (!rc4salt)
+ return GSS_S_FAILURE;
+
if (arcfour_hmac_md5_usage_to_salt(usage, rc4salt)) {
dprintk("%s: invalid usage value %u\n", __func__, usage);
- return GSS_S_FAILURE;
+ goto out_free_rc4salt;
}
checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
if (!checksumdata)
- return GSS_S_FAILURE;
+ goto out_free_rc4salt;
md5 = crypto_alloc_ahash("md5", 0, CRYPTO_ALG_ASYNC);
if (IS_ERR(md5))
@@ -258,6 +262,8 @@ out_free_md5:
crypto_free_ahash(md5);
out_free_cksum:
kfree(checksumdata);
+out_free_rc4salt:
+ kfree(rc4salt);
return err ? GSS_S_FAILURE : 0;
}
next prev parent reply other threads:[~2018-09-13 13:31 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-13 13:30 [PATCH 4.9 00/78] 4.9.127-stable review Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 01/78] x86/speculation/l1tf: Fix up pte->pfn conversion for PAE Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 02/78] act_ife: fix a potential use-after-free Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 03/78] ipv4: tcp: send zero IPID for RST and ACK sent in SYN-RECV and TIME-WAIT state Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 04/78] net: bcmgenet: use MAC link status for fixed phy Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 05/78] net: sched: Fix memory exposure from short TCA_U32_SEL Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 06/78] qlge: Fix netdev features configuration Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 07/78] r8169: add support for NCube 8168 network card Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 08/78] tcp: do not restart timewait timer on rst reception Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 09/78] vti6: remove !skb->ignore_df check from vti6_xmit() Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 10/78] sctp: hold transport before accessing its asoc in sctp_transport_get_next Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 11/78] vhost: correctly check the iova range when waking virtqueue Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.9 12/78] hv_netvsc: ignore devices that are not PCI Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 13/78] act_ife: move tcfa_lock down to where necessary Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 14/78] act_ife: fix a potential deadlock Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 15/78] net: sched: action_ife: take reference to meta module Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 16/78] cifs: check if SMB2 PDU size has been padded and suppress the warning Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 17/78] hfsplus: dont return 0 when fill_super() failed Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 18/78] hfs: prevent crash on exit from failed search Greg Kroah-Hartman
2018-09-13 13:31 ` Greg Kroah-Hartman [this message]
2018-09-13 13:31 ` [PATCH 4.9 20/78] fork: dont copy inconsistent signal handler state to child Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 21/78] reiserfs: change j_timestamp type to time64_t Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 22/78] hfsplus: fix NULL dereference in hfsplus_lookup() Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 23/78] fat: validate ->i_start before using Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 24/78] scripts: modpost: check memory allocation results Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 25/78] virtio: pci-legacy: Validate queue pfn Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 26/78] mm/fadvise.c: fix signed overflow UBSAN complaint Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 27/78] fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot() Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 28/78] platform/x86: intel_punit_ipc: fix build errors Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 29/78] s390/kdump: Fix memleak in nt_vmcoreinfo Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 30/78] ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest() Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 31/78] mfd: sm501: Set coherent_dma_mask when creating subdevices Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 32/78] platform/x86: asus-nb-wmi: Add keymap entry for lid flip action on UX360 Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 33/78] RDMA/hns: Fix usage of bitmap allocation functions return values Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 34/78] irqchip/bcm7038-l1: Hide cpu offline callback when building for !SMP Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 35/78] net/9p/trans_fd.c: fix race by holding the lock Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 36/78] net/9p: fix error path of p9_virtio_probe Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 37/78] powerpc: Fix size calculation using resource_size() Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 38/78] perf probe powerpc: Fix trace event post-processing Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 39/78] block: bvec_nr_vecs() returns value for wrong slab Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 40/78] s390/dasd: fix hanging offline processing due to canceled worker Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 41/78] s390/dasd: fix panic for failed online processing Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 42/78] ACPI / scan: Initialize status to ACPI_STA_DEFAULT Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 43/78] scsi: aic94xx: fix an error code in aic94xx_init() Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 44/78] PCI: mvebu: Fix I/O space end address calculation Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 45/78] dm kcopyd: avoid softlockup in run_complete_job Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 46/78] staging: comedi: ni_mio_common: fix subdevice flags for PFI subdevice Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 47/78] selftests/powerpc: Kill child processes on SIGINT Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 48/78] RDS: IB: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 49/78] smb3: fix reset of bytes read and written stats Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 50/78] SMB3: Number of requests sent should be displayed for SMB3 not just CIFS Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 51/78] powerpc/pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 52/78] clk: rockchip: Add pclk_rkpwm_pmu to PMU critical clocks in rk3399 Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 53/78] btrfs: replace: Reset on-disk dev stats value after replace Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 54/78] btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 55/78] btrfs: Dont remove block group that still has pinned down bytes Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 56/78] arm64: rockchip: Force CONFIG_PM on Rockchip systems Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 57/78] ARM: " Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 58/78] drm/edid: Add 6 bpc quirk for SDC panel in Lenovo B50-80 Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 59/78] tcp: Revert "tcp: tcp_probe: use spin_lock_bh()" Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 60/78] debugobjects: Make stack check warning more informative Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 61/78] x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 62/78] kbuild: make missing $DEPMOD a Warning instead of an Error Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 63/78] irda: Fix memory leak caused by repeated binds of irda socket Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 64/78] irda: Only insert new objects into the global database via setsockopt Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 65/78] Revert "ARM: imx_v6_v7_defconfig: Select ULPI support" Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 66/78] enic: do not call enic_change_mtu in enic_probe Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 67/78] Fixes: Commit 2aa6d036b716 ("mm: numa: avoid waiting on freed migrated pages") Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 68/78] sch_htb: fix crash on init failure Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 69/78] sch_multiq: fix double free " Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 70/78] sch_hhf: fix null pointer dereference " Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 71/78] sch_netem: avoid null pointer deref " Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.9 72/78] sch_tbf: fix two null pointer dereferences " Greg Kroah-Hartman
2018-09-13 13:32 ` [PATCH 4.9 73/78] mei: me: allow runtime pm for platform with D0i3 Greg Kroah-Hartman
2018-09-13 13:32 ` [PATCH 4.9 74/78] s390/lib: use expoline for all bcr instructions Greg Kroah-Hartman
2018-09-13 13:32 ` [PATCH 4.9 75/78] ASoC: wm8994: Fix missing break in switch Greg Kroah-Hartman
2018-09-13 13:32 ` [PATCH 4.9 76/78] btrfs: use correct compare function of dirty_metadata_bytes Greg Kroah-Hartman
2018-09-13 13:32 ` [PATCH 4.9 77/78] arm64: Fix mismatched cache line size detection Greg Kroah-Hartman
2018-09-13 13:32 ` [PATCH 4.9 78/78] arm64: Handle mismatched cache type Greg Kroah-Hartman
2018-09-13 19:10 ` [PATCH 4.9 00/78] 4.9.127-stable review Nathan Chancellor
2018-09-14 12:42 ` Naresh Kamboju
2018-09-14 14:55 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180913131806.988428353@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alexander.levin@microsoft.com \
--cc=bfields@redhat.com \
--cc=labbott@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).