]> git.baikalelectronics.ru Git - kernel.git/commit
SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache
authorTrond Myklebust <trond.myklebust@hammerspace.com>
Mon, 12 Nov 2018 20:30:52 +0000 (15:30 -0500)
committerTrond Myklebust <trond.myklebust@hammerspace.com>
Mon, 12 Nov 2018 21:39:13 +0000 (16:39 -0500)
commit5de7bcd1a00c97b2253a2818996ea319d871462c
tree6af76bd83128cde0a9992a5e223f377b72851bae
parente76d3c04158b8a206d70142ff56419f5bbc03cfd
SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache

Commit 96b670d8183f causes a use-after free in the RPCSEC_GSS credential
destroy code, because the call to get_rpccred() in gss_destroying_context()
will now always fail to increment the refcount.

While we could just replace the get_rpccred() with a refcount_set(), that
would have the unfortunate consequence of resurrecting a credential in
the credential cache for which we are in the process of destroying the
RPCSEC_GSS context. Rather than do this, we choose to make a copy that
is never added to the cache and use that to destroy the context.

Fixes: 96b670d8183f ("SUNRPC: Simplify lookup code")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
net/sunrpc/auth_gss/auth_gss.c