Joshua RogersandGreg Kroah-Hartman 7452d53f29 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf ...

commit d4b69a6186 upstream.

A zero length gss_token results in pages == 0 and in_token->pages[0]
is NULL. The code unconditionally evaluates
page_address(in_token->pages[0]) for the initial memcpy, which can
dereference NULL even when the copy length is 0. Guard the first
memcpy so it only runs when length > 0.

Fixes: 5866efa8cb ("SUNRPC: Fix svcauth_gss_proxy_init()")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-11 15:22:02 +01:00

..

auth_gss

SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

2026-01-11 15:22:02 +01:00

xprtrdma

svcrdma: return 0 on success from svc_rdma_copy_inline_range

2026-01-11 15:22:02 +01:00

.kunitconfig

…

addr.c

…

auth_null.c

…

auth_tls.c

…

auth_unix.c

…

auth.c

…

backchannel_rqst.c

…

cache.c

sunrpc: suppress warnings for unused procfs functions

2025-03-07 16:45:37 +01:00

clnt.c

sunrpc: don't immediately retransmit on seqno miss

2025-07-06 11:00:05 +02:00

debugfs.c

…

fail.h

…

Kconfig

…

Makefile

…

netns.h

…

rpc_pipe.c

…

rpcb_clnt.c

SUNRPC: rpcbind should never reset the port to the value '0'

2025-06-04 14:41:55 +02:00

sched.c

Revert "SUNRPC: Don't allow waiting for exiting tasks"

2025-09-19 16:32:03 +02:00

socklib.c

…

socklib.h

…

stats.c

sunrpc: use the struct net as the svc proc private

2024-08-19 06:04:23 +02:00

sunrpc_syms.c

…

sunrpc.h

…

svc_xprt.c

…

svc.c

sunrpc: handle SVC_GARBAGE during svc auth processing as auth error

2025-06-27 11:09:00 +01:00

svcauth_unix.c

…

svcauth.c

…

svcsock.c

net: better track kernel sockets lifetime

2025-08-28 16:28:39 +02:00

sysctl.c

…

sysfs.c

…

sysfs.h

…

timer.c

…

xdr.c

…

xprt.c

…

xprtmultipath.c

…

xprtsock.c

SUNRPC: call xs_sock_process_cmsg for all cmsg

2025-09-19 16:32:01 +02:00