提交 7a42e82e 编写于 作者: N NeilBrown 提交者: Yang Yingliang

sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations.

hulk inclusion
category: bugfix
bugzilla: NA
CVE: CVE-2020-12656

---------------------------

There is no valid case for supporting duplicate pseudoflavor
registrations.
Currently the silent acceptance of such registrations is hiding a bug.
The rpcsec_gss_krb5 module registers 2 flavours but does not unregister
them, so if you load, unload, reload the module, it will happily
continue to use the old registration which now has pointers to the
memory were the module was originally loaded.  This could lead to
unexpected results.

So disallow duplicate registrations.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=206651
Cc: stable@vger.kernel.org (v2.6.12+)
Signed-off-by: NNeilBrown <neilb@suse.de>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NWenan Mao <maowenan@huawei.com>
Reviewed-by: NJason Yan <yanaijie@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
上级 4e6cd5e4
...@@ -796,9 +796,11 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name) ...@@ -796,9 +796,11 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
new->h.flavour = &svcauthops_gss; new->h.flavour = &svcauthops_gss;
new->pseudoflavor = pseudoflavor; new->pseudoflavor = pseudoflavor;
stat = 0;
test = auth_domain_lookup(name, &new->h); test = auth_domain_lookup(name, &new->h);
if (test != &new->h) { /* Duplicate registration */ if (test != &new->h) {
pr_warn("svc: duplicate registration of gss pseudo flavour %s.\n",
name);
stat = -EADDRINUSE;
auth_domain_put(test); auth_domain_put(test);
kfree(new->h.name); kfree(new->h.name);
goto out_free_dom; goto out_free_dom;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册