Dave Wysochanski e4a7d1f770 SUNRPC: Handle 0 length opaque XDR object data properly ... When handling an auth_gss downcall, it's possible to get 0-length opaque object for the acceptor. In the case of a 0-length XDR object, make sure simple_get_netobj() fills in dest->data = NULL, and does not continue to kmemdup() which will set dest->data = ZERO_SIZE_PTR for the acceptor. The trace event code can handle NULL but not ZERO_SIZE_PTR for a string, and so without this patch the rpcgss_context trace event will crash the kernel as follows: [ 162.887992] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 162.898693] #PF: supervisor read access in kernel mode [ 162.900830] #PF: error_code(0x0000) - not-present page [ 162.902940] PGD 0 P4D 0 [ 162.904027] Oops: 0000 [#1] SMP PTI [ 162.905493] CPU: 4 PID: 4321 Comm: rpc.gssd Kdump: loaded Not tainted 5.10.0 #133 [ 162.908548] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 162.910978] RIP: 0010:strlen+0x0/0x20 [ 162.912505] Code: 48 89 f9 74 09 48 83 c1 01 80 39 00 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 0f 1f 80 00 00 00 00 <80> 3f 00 74 10 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 31 [ 162.920101] RSP: 0018:ffffaec900c77d90 EFLAGS: 00010202 [ 162.922263] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffde697 [ 162.925158] RDX: 000000000000002f RSI: 0000000000000080 RDI: 0000000000000010 [ 162.928073] RBP: 0000000000000010 R08: 0000000000000e10 R09: 0000000000000000 [ 162.930976] R10: ffff8e698a590cb8 R11: 0000000000000001 R12: 0000000000000e10 [ 162.933883] R13: 00000000fffde697 R14: 000000010034d517 R15: 0000000000070028 [ 162.936777] FS: 00007f1e1eb93700(0000) GS:ffff8e6ab7d00000(0000) knlGS:0000000000000000 [ 162.940067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.942417] CR2: 0000000000000010 CR3: 0000000104eba000 CR4: 00000000000406e0 [ 162.945300] Call Trace: [ 162.946428] trace_event_raw_event_rpcgss_context+0x84/0x140 [auth_rpcgss] [ 162.949308] ? __kmalloc_track_caller+0x35/0x5a0 [ 162.951224] ? gss_pipe_downcall+0x3a3/0x6a0 [auth_rpcgss] [ 162.953484] gss_pipe_downcall+0x585/0x6a0 [auth_rpcgss] [ 162.955953] rpc_pipe_write+0x58/0x70 [sunrpc] [ 162.957849] vfs_write+0xcb/0x2c0 [ 162.959264] ksys_write+0x68/0xe0 [ 162.960706] do_syscall_64+0x33/0x40 [ 162.962238] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 162.964346] RIP: 0033:0x7f1e1f1e57df Signed-off-by: Dave Wysochanski <dwysocha@redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>		2021-01-25 15:59:12 -05:00
..
6lowpan
9p	9p for 5.11-rc1	2020-12-21 10:28:02 -08:00
802
8021q	net: make free_netdev() more lenient with unregistering devices	2021-01-08 19:27:41 -08:00
appletalk	net: appletalk: fix kerneldoc warnings	2020-10-30 11:48:17 -07:00
atm	atm: nicstar: Replace in_interrupt() usage	2020-11-18 16:43:55 -08:00
ax25
batman-adv	batman-adv: Drop unused soft-interface.h include in fragmentation.c	2020-12-04 08:41:16 +01:00
bluetooth	Bluetooth: Increment management interface revision	2020-12-07 17:02:00 +02:00
bpf	bpf: Reject too big ctx_size_in for raw_tp test run	2021-01-13 19:31:43 -08:00
bpfilter	Revert "bpfilter: Fix build error with CONFIG_BPFILTER_UMH"	2020-10-15 12:33:24 -07:00
bridge	net: bridge: Fix a warning when del bridge sysfs	2020-12-14 18:27:49 -08:00
caif
can	can: isotp: isotp_getname(): fix kernel information leak	2021-01-13 22:15:13 +01:00
ceph	libceph: fix "Boolean result is used in bitwise operation" warning	2021-01-21 16:49:59 +01:00
core	net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled	2021-01-19 15:58:05 -08:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-12 15:55:21 -08:00
dccp	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
decnet	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
dns_resolver
dsa	net: dsa: clear devlink port type before unregistering slave netdevs	2021-01-12 18:48:50 -08:00
ethernet	net: datagram: fix some kernel-doc markups	2020-11-17 14:15:03 -08:00
ethtool	ethtool: fix error paths in ethnl_set_channels()	2020-12-16 13:27:17 -08:00
hsr	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ieee802154	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
ife
ipv4	tcp: Fix potential use-after-free due to double kfree()	2021-01-20 08:56:16 -08:00
ipv6	ipv6: set multicast flag on the multicast route	2021-01-18 19:52:37 -08:00
iucv	net/af_iucv: use DECLARE_SOCKADDR to cast from sockaddr	2020-12-08 15:56:53 -08:00
kcm
key
l2tp	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
l3mdev	net: l3mdev: Fix kerneldoc warning	2020-10-30 11:43:42 -07:00
lapb	net: lapb: Decrease the refcount of "struct lapb_cb" in lapb_device_event	2021-01-04 13:42:41 -08:00
llc	net: llc: Fix kerneldoc warnings	2020-10-30 11:34:09 -07:00
mac80211	mac80211: check if atf has been disabled in __ieee80211_schedule_txq	2021-01-14 22:27:38 +01:00
mac802154	net: mac802154: convert tasklets to use new tasklet_setup() API	2020-11-07 10:40:56 -08:00
mpls	mpls: drop skb's dst in mpls_forward()	2020-11-03 12:55:53 -08:00
mptcp	mptcp: fix locking in mptcp_disconnect()	2021-01-14 11:25:21 -08:00
ncsi	net/ncsi: Use real net-device for response handler	2020-12-23 12:22:23 -08:00
netfilter	netfilter: nf_nat: Fix memleak in nf_nat_init	2021-01-11 00:34:11 +01:00
netlabel	Merge https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-11-19 19:08:46 -08:00
netlink	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netrom
nfc	net: nfc: nci: fix the wrong NCI_CORE_INIT parameters	2021-01-19 16:49:28 -08:00
nsh
openvswitch	net: openvswitch: fix TTL decrement exception action execution	2020-12-14 17:18:25 -08:00
packet	net: af_packet: fix procfs header for 64-bit pointers	2020-12-18 12:17:23 -08:00
phonet
psample	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
qrtr	net: qrtr: fix null-ptr-deref in qrtr_ns_remove	2021-01-05 16:50:09 -08:00
rds	rds: stop using dmapool	2020-11-17 15:22:06 -04:00
rfkill	rfkill: add a reason to the HW rfkill state	2020-12-11 12:47:17 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Call state should be read with READ_ONCE() under some circumstances	2021-01-13 10:38:20 -08:00
sched	net_sched: avoid shift-out-of-bounds in tcindex_set_parms()	2021-01-15 18:11:10 -08:00
sctp	sctp: Fix some typo	2020-11-23 17:44:11 -08:00
smc	net/smc: use memcpy instead of snprintf to avoid out of bounds read	2021-01-12 20:22:01 -08:00
strparser
sunrpc	SUNRPC: Handle 0 length opaque XDR object data properly	2021-01-25 15:59:12 -05:00
switchdev	net: switchdev: Fixed kerneldoc warning	2020-09-23 17:46:31 -07:00
tipc	net: tip: fix a couple kernel-doc markups	2021-01-14 10:30:24 -08:00
tls	net: fix proc_fs init handling in af_packet and tls	2020-12-14 19:39:30 -08:00
unix	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
vmw_vsock	af_vsock: Assign the vsock transport considering the vsock address flags	2020-12-14 19:33:39 -08:00
wireless	cfg80211: Save the regulatory domain with a lock	2021-01-08 21:03:27 +01:00
x25	net: x25: Remove unimplemented X.25-over-LLC code stubs	2020-12-12 17:15:33 -08:00
xdp	xsk: Clear pool even for inactive queues	2021-01-19 22:47:04 +01:00
xfrm	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c
Kconfig	wimax: move out to staging	2020-10-29 19:27:45 +01:00
Makefile	wimax: move out to staging	2020-10-29 19:27:45 +01:00
socket.c	for-5.11/io_uring-2020-12-14	2020-12-16 12:44:05 -08:00
sysctl_net.c