diff options
| author | Lei Lu <llfamsec@gmail.com> | 2025-08-11 21:58:48 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-15 11:58:09 +0200 |
| commit | 81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 (patch) | |
| tree | 3d6aa578f7bc2493d20b73804643050adc9188ae /net/sunrpc | |
| parent | fd8a23ecbc602d00e47b27f20b07350867d0ebe5 (diff) | |
| download | linux-81cec07d303186d0d8c623ef8b5ecd3b81e94cf6.tar.gz linux-81cec07d303186d0d8c623ef8b5ecd3b81e94cf6.tar.bz2 linux-81cec07d303186d0d8c623ef8b5ecd3b81e94cf6.zip | |
sunrpc: fix null pointer dereference on zero-length checksum
commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream.
In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes
checksum.data to be set to NULL. This triggers a NPD when accessing
checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that
the value of checksum.len is not less than XDR_UNIT.
Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream")
Cc: stable@kernel.org
Signed-off-by: Lei Lu <llfamsec@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/sunrpc')
| -rw-r--r-- | net/sunrpc/auth_gss/svcauth_gss.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index cf30bd649e27..d063b63516f8 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci, rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } - if (flavor != RPC_AUTH_GSS) { + if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) { rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } |