github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

SUNRPC: fix oversized GSS proxy token copy

Browse Source 
gss_read_proxy_verf() allocates one page per token chunk, but it copies the
entire linear head of an RPC request into in_token->pages[0]. A UDP datagram
can leave more than PAGE_SIZE bytes in the linear head, so a large
RPCSEC_GSS INIT token overwrites following pages.

Copy the linear head in page-sized chunks before switching to the request
page array. The linear head itself can span multiple pages.

Fixes: 5866efa8cb ("SUNRPC: Fix svcauth_gss_proxy_init()")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Assisted-by: Codex:gpt-5
Link: https://patch.msgid.link/20260910125120.3798995-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Chuck Lever <cel@kernel.org>
This commit is contained in:
Jérémy Jean 2026-09-10 12:51:20 +00:00 committed by Chuck Lever
parent d1caedce2d
commit 62319c2534
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/sunrpc/auth_gss/svcauth_gss.c
View File

@ -1085,10 +1085,11 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
}
length = min_t(unsigned int, inlen, (char *)xdr->end - (char *)xdr->p);
if (length)
memcpy(page_address(in_token->pages[0]), xdr->p, length);
for (to_offs = 0; to_offs < length; to_offs += PAGE_SIZE)
memcpy(page_address(in_token->pages[to_offs >> PAGE_SHIFT]),
(char *)xdr->p + to_offs,
min_t(unsigned int, length - to_offs, PAGE_SIZE));
inlen -= length;
to_offs = length;
from_offs = rqstp->rq_arg.page_base;
while (inlen) {