Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
Revision a652a4bc21695a57c3b8d13d222a6f8b41f100aa authored by Trond Myklebust on 12 November 2018, 20:30:52 UTC, committed by Trond Myklebust on 12 November 2018, 21:39:13 UTC 
SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache
 
Commit 07d02a67b7fa causes a use-after free in the RPCSEC_GSS credential
destroy code, because the call to get_rpccred() in gss_destroying_context()
will now always fail to increment the refcount.

While we could just replace the get_rpccred() with a refcount_set(), that
would have the unfortunate consequence of resurrecting a credential in
the credential cache for which we are in the process of destroying the
RPCSEC_GSS context. Rather than do this, we choose to make a copy that
is never added to the cache and use that to destroy the context.

Fixes: 07d02a67b7fa ("SUNRPC: Simplify lookup code")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
1 parent a1aa09b
History
Tip revision: a652a4bc21695a57c3b8d13d222a6f8b41f100aa authored by Trond Myklebust on 12 November 2018, 20:30:52 UTC
SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache
Tip revision: a652a4b
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 12.7 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.5 KB
.mailmap -rw-r--r-- 10.5 KB
COPYING -rw-r--r-- 423 bytes
CREDITS -rw-r--r-- 96.4 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 563 bytes
MAINTAINERS -rw-r--r-- 470.7 KB
Makefile -rw-r--r-- 59.7 KB
README -rw-r--r-- 727 bytes

README

back to top