From patchwork Thu Jan 21 21:17:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Wysochanski X-Patchwork-Id: 12037809 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4F27C433E6 for ; Thu, 21 Jan 2021 21:23:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8A44823381 for ; Thu, 21 Jan 2021 21:23:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726000AbhAUVXa (ORCPT ); Thu, 21 Jan 2021 16:23:30 -0500 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:24669 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726286AbhAUVX1 (ORCPT ); Thu, 21 Jan 2021 16:23:27 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1611264121; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc; bh=zbWs5oPcE4nzYe2QsPBjXZwgm0sLaHUc5dN1GqtXWGU=; b=Fx8b4/UzU66yP6Vbrrky0rRlbcsgQ5BAkSKWdzsmcDCgmZ+Vot4WD2J5oUAVsEg3AC/QH1 3TBnETBaeOmM4plJNFkTTrfHrsgnWl74OCMKPVeznb3HBLBQpKFhrAnUAWjU7dmc89PSav MMVF3uUbKNiXj4ZTcVXqlO19yCxw6ZY= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-559-yMIMXtyPOv-JBLzdQUO0iQ-1; Thu, 21 Jan 2021 16:17:38 -0500 X-MC-Unique: yMIMXtyPOv-JBLzdQUO0iQ-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 5BC7418C8C01; Thu, 21 Jan 2021 21:17:37 +0000 (UTC) Received: from dwysocha.rdu.csb (ovpn-113-28.rdu2.redhat.com [10.10.113.28]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 682DE61F55; Thu, 21 Jan 2021 21:17:36 +0000 (UTC) From: Dave Wysochanski To: Trond Myklebust , Anna Schumaker Cc: linux-nfs@vger.kernel.org Subject: [PATCH v3 0/2] Fix crash in trace_rpcgss_context due to 0-length acceptor Date: Thu, 21 Jan 2021 16:17:22 -0500 Message-Id: <1611263844-32608-1-git-send-email-dwysocha@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org Changes from v2 * Move simple_get_bytes and simple_get_netobj into private header This small patchset fixes a kernel crash when the rpcgss_context trace event is enabled and IO is in flight when a kerberos ticket expires. The crash occurs because the acceptor name may be 0 bytes long and the gss_fill_context() function does not handle it properly. This causes the ctx->gc_acceptor.data to be ZERO_SIZE_PTR which is not properly recognized by the tracepoint code. The first patch is a simple refactor and eliminates duplicate helper functions related to the crash. The second patch is the actual fix inside one of the helper functions due to the definition of an opaque XDR object. This object is defined in RFC 4506 (see section 4.10), where 'length' is an integer in a range including 0. Reproducer # Enable the tracepoint and mount the share trace-cmd start -e rpcgss:* mount -osec=krb5 nfs-server:/export /mnt/nfs # Obtain a kerberos ticket # Set ticket lifetime to something small like 20 seconds su test -c "kinit -l 20 test" # Sleep for a portion of the ticket lifetime so we are writing while the ticket expires sleep 10 # Now run some IO long enough that the ticket expires midway dd if=/dev/urandom of=/mnt/nfs/file bs=1M count=100 Dave Wysochanski (2): SUNRPC: Move simple_get_bytes and simple_get_netobj into private header SUNRPC: Handle 0 length opaque XDR object data properly include/linux/sunrpc/xdr.h | 3 +-- net/sunrpc/auth_gss/auth_gss.c | 30 +--------------------- net/sunrpc/auth_gss/auth_gss_internal.h | 45 +++++++++++++++++++++++++++++++++ net/sunrpc/auth_gss/gss_krb5_mech.c | 31 ++--------------------- 4 files changed, 49 insertions(+), 60 deletions(-) create mode 100644 net/sunrpc/auth_gss/auth_gss_internal.h