Dave Wysochanski 518416a75c SUNRPC: Handle 0 length opaque XDR object data properly ... [ Upstream commit e4a7d1f770 ] When handling an auth_gss downcall, it's possible to get 0-length opaque object for the acceptor. In the case of a 0-length XDR object, make sure simple_get_netobj() fills in dest->data = NULL, and does not continue to kmemdup() which will set dest->data = ZERO_SIZE_PTR for the acceptor. The trace event code can handle NULL but not ZERO_SIZE_PTR for a string, and so without this patch the rpcgss_context trace event will crash the kernel as follows: [ 162.887992] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 162.898693] #PF: supervisor read access in kernel mode [ 162.900830] #PF: error_code(0x0000) - not-present page [ 162.902940] PGD 0 P4D 0 [ 162.904027] Oops: 0000 [#1] SMP PTI [ 162.905493] CPU: 4 PID: 4321 Comm: rpc.gssd Kdump: loaded Not tainted 5.10.0 #133 [ 162.908548] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 162.910978] RIP: 0010:strlen+0x0/0x20 [ 162.912505] Code: 48 89 f9 74 09 48 83 c1 01 80 39 00 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 0f 1f 80 00 00 00 00 <80> 3f 00 74 10 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 31 [ 162.920101] RSP: 0018:ffffaec900c77d90 EFLAGS: 00010202 [ 162.922263] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffde697 [ 162.925158] RDX: 000000000000002f RSI: 0000000000000080 RDI: 0000000000000010 [ 162.928073] RBP: 0000000000000010 R08: 0000000000000e10 R09: 0000000000000000 [ 162.930976] R10: ffff8e698a590cb8 R11: 0000000000000001 R12: 0000000000000e10 [ 162.933883] R13: 00000000fffde697 R14: 000000010034d517 R15: 0000000000070028 [ 162.936777] FS: 00007f1e1eb93700(0000) GS:ffff8e6ab7d00000(0000) knlGS:0000000000000000 [ 162.940067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.942417] CR2: 0000000000000010 CR3: 0000000104eba000 CR4: 00000000000406e0 [ 162.945300] Call Trace: [ 162.946428] trace_event_raw_event_rpcgss_context+0x84/0x140 [auth_rpcgss] [ 162.949308] ? __kmalloc_track_caller+0x35/0x5a0 [ 162.951224] ? gss_pipe_downcall+0x3a3/0x6a0 [auth_rpcgss] [ 162.953484] gss_pipe_downcall+0x585/0x6a0 [auth_rpcgss] [ 162.955953] rpc_pipe_write+0x58/0x70 [sunrpc] [ 162.957849] vfs_write+0xcb/0x2c0 [ 162.959264] ksys_write+0x68/0xe0 [ 162.960706] do_syscall_64+0x33/0x40 [ 162.962238] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 162.964346] RIP: 0033:0x7f1e1f1e57df Signed-off-by: Dave Wysochanski <dwysocha@redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-02-13 13:55:12 +01:00
..
6lowpan
9p	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid	2020-10-12 10:05:47 +02:00
802
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:16:55 +01:00
appletalk
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25
batman-adv	batman-adv: Don't always reallocate the fragmentation skb head	2020-11-27 08:02:55 +01:00
bluetooth	Bluetooth: Fix attempting to set RPA timeout when unsupported	2021-01-09 13:46:23 +01:00
bpf	bpf: Reject too big ctx_size_in for raw_tp test run	2021-01-27 11:55:07 +01:00
bpfilter	Revert "bpfilter: Fix build error with CONFIG_BPFILTER_UMH"	2020-10-15 12:33:24 -07:00
bridge	bridge: Fix a deadlock when enabling multicast snooping	2020-12-07 17:14:43 -08:00
caif
can	can: isotp: isotp_getname(): fix kernel information leak	2021-01-17 14:17:05 +01:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	neighbour: Prevent a dead entry from updating gc_list	2021-02-10 09:29:22 +01:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	tcp: fix race condition when creating child sockets from syncookies	2020-11-23 16:32:33 -08:00
decnet
dns_resolver
dsa	net: dsa: unbind all switches from tree when DSA master unbinds	2021-01-23 16:04:05 +01:00
ethernet
ethtool	ethtool: fix string set id check	2021-01-06 14:56:48 +01:00
hsr	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ieee802154	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ife
ipv4	udp: ipv4: manipulate network header of NATed UDP GRO fraglist	2021-02-10 09:29:23 +01:00
ipv6	udp: ipv4: manipulate network header of NATed UDP GRO fraglist	2021-02-10 09:29:23 +01:00
iucv	net/af_iucv: set correct sk_protocol for child sockets	2020-11-21 14:43:45 -08:00
kcm
key	af_key: relax availability checks for skb size calculation	2021-02-13 13:55:02 +01:00
l2tp	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc
mac80211	mac80211: 160MHz with extended NSS BW in CSA	2021-02-13 13:55:04 +01:00
mac802154
mpls	mpls: load mpls_gso after mpls_iptunnel	2020-10-20 21:16:45 -07:00
mptcp	mptcp: fix security context on server socket	2021-01-06 14:56:48 +01:00
ncsi	net/ncsi: Use real net-device for response handler	2021-01-12 20:18:10 +01:00
netfilter	netfilter: nft_dynset: add timeout extension to template	2021-02-03 23:28:44 +01:00
netlabel	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()	2020-11-14 12:07:57 -08:00
netlink	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netrom
nfc	NFC: fix possible resource leak	2021-02-03 23:28:51 +01:00
nsh
openvswitch	openvswitch: fix error return code in validate_and_copy_dec_ttl()	2020-12-04 15:43:14 -08:00
packet	net/packet: fix packet receive on L3 devices without visible hard header	2020-11-23 17:29:36 -08:00
phonet
psample	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
qrtr	net: qrtr: ns: Fix the incorrect usage of rcu_read_lock()	2020-10-06 06:01:35 -07:00
rds	RDMA: Add rdma_connect_locked()	2020-10-28 09:14:49 -03:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix deadlock around release of dst cached on udp tunnel	2021-02-10 09:29:13 +01:00
sched	net_sched: reject silly cell_log in qdisc_get_rtab()	2021-01-27 11:55:24 +01:00
sctp	sctp: change to hold/put transport for proto_unreach_timer	2020-11-14 11:57:12 -08:00
smc	net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()	2020-11-19 10:59:19 -08:00
strparser
sunrpc	SUNRPC: Handle 0 length opaque XDR object data properly	2021-02-13 13:55:12 +01:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: fix NULL deref in tipc_link_xmit()	2021-01-23 16:04:00 +01:00
tls	net/tls: Protect from calling tls_dev_del for TLS RX twice	2020-11-25 17:31:06 -08:00
unix	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
vmw_vsock	vsock: fix the race conditions in multi-transport support	2021-02-03 23:28:52 +01:00
wimax	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
wireless	wext: fix NULL-ptr-dereference with cfg80211's lack of commit()	2021-02-03 23:28:38 +01:00
x25	net/x25: prevent a couple of overflows	2020-12-02 17:26:36 -08:00
xdp	xsk: Clear pool even for inactive queues	2021-01-27 11:55:10 +01:00
xfrm	xfrm: Fix wraparound in xfrm_policy_addr_delta()	2021-02-03 23:28:45 +01:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c
Kconfig	drop_monitor: Convert to using devlink tracepoint	2020-09-30 18:01:26 -07:00
Makefile
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
sysctl_net.c