]> git.itanic.dy.fi Git - linux-stable/commit
SUNRPC: Fix a use after free when a server rejects the RPCSEC_GSS credential
authorTrond Myklebust <trond.myklebust@hammerspace.com>
Wed, 29 May 2019 16:49:52 +0000 (12:49 -0400)
committerAnna Schumaker <Anna.Schumaker@Netapp.com>
Thu, 30 May 2019 19:29:41 +0000 (15:29 -0400)
commit7987b694ade8cc465ce10fb3dceaa614f13ceaf3
tree5c71e423c301bd079f8bcf7f298ffd6688600d1d
parentec6017d9035986a36de064f48a63245930bfad6f
SUNRPC: Fix a use after free when a server rejects the RPCSEC_GSS credential

The addition of rpc_check_timeout() to call_decode causes an Oops
when the RPCSEC_GSS credential is rejected.
The reason is that rpc_decode_header() will call xprt_release() in
order to free task->tk_rqstp, which is needed by rpc_check_timeout()
to check whether or not we should exit due to a soft timeout.

The fix is to move the call to xprt_release() into call_decode() so
we can perform it after rpc_check_timeout().

Reported-by: Olga Kornievskaia <olga.kornievskaia@gmail.com>
Reported-by: Nick Bowler <nbowler@draconx.ca>
Fixes: cea57789e408 ("SUNRPC: Clean up")
Cc: stable@vger.kernel.org # v5.1+
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
net/sunrpc/clnt.c