Chuck Lever a20cecece4 SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() ...

commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.

@subbuf is an output parameter of xdr_buf_subsegment(). A survey of
call sites shows that @subbuf is always uninitialized before
xdr_buf_segment() is invoked by callers.

There are some execution paths through xdr_buf_subsegment() that do
not set all of the fields in @subbuf, leaving some pointer fields
containing garbage addresses. Subsequent processing of that buffer
then results in a page fault.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2020-06-30 15:38:45 -04:00

..

auth_gss

sunrpc: clean up properly in gss_mech_unregister()

2020-06-20 10:24:21 +02:00

xprtrdma

xprtrdma: Fix backchannel allocation of extra rpcrdma_reps

2020-05-10 10:28:03 +02:00

addr.c

net: sunrpc: Fix off-by-one issues in 'rpc_ntop6'

2020-06-30 15:38:27 -04:00

auth_generic.c

SUNRPC: Fix a bogus get/put in generic_key_to_expire()

2018-12-01 09:44:21 +01:00

auth_null.c

sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags

2016-07-19 16:23:24 -04:00

auth_unix.c

NFS client updates for Linux 4.9

2016-10-13 21:28:20 -07:00

auth.c

sunrpc: replace generic auth_cred hash with auth-specific function

2016-09-30 15:47:47 -04:00

backchannel_rqst.c

SUNRPC: Refactor rpc_xdr_buf_init()

2016-09-19 13:08:37 -04:00

cache.c

sunrpc: fix crash when cache_head become valid before update

2019-12-21 10:42:19 +01:00

clnt.c

net :sunrpc :clnt :Fix xps refcount imbalance on the error path

2019-07-21 09:05:57 +02:00

debugfs.c

SUNRPC: Address kbuild warning in net/sunrpc/debugfs.c

2015-06-11 14:01:06 -04:00

Kconfig

rpcrdma: Merge svcrdma and xprtrdma modules into one

2015-06-04 16:56:02 -04:00

Makefile

SUNRPC: Add a structure to track multiple transports

2016-02-05 18:48:54 -05:00

netns.h

…

rpc_pipe.c

sunrpc: fixed rollback in rpc_gssd_dummy_populate()

2020-06-30 15:38:45 -04:00

rpcb_clnt.c

sunrpc: handle ENOMEM in rpcb_getport_async

2019-01-23 08:10:55 +01:00

sched.c

SUNRPC: Fix priority queue fairness

2019-11-25 09:53:19 +01:00

socklib.c

sunrpc: do not pull udp headers on receive

2016-04-11 15:31:33 -04:00

stats.c

…

sunrpc_syms.c

SUNRPC: cleanup ida information when removing sunrpc module

2017-02-01 08:33:09 +01:00

sunrpc.h

…

svc_xprt.c

sunrpc: use-after-free in svc_process_common()

2019-01-16 22:12:33 +01:00

svc.c

sunrpc: use-after-free in svc_process_common()

2019-01-16 22:12:33 +01:00

svcauth_unix.c

kernel: make groups_sort calling a responsibility group_info allocators

2018-01-10 09:29:52 +01:00

svcauth.c

svcrpc: move some initialization to common code

2015-11-24 10:39:16 -07:00

svcsock.c

sunrpc: use-after-free in svc_process_common()

2019-01-16 22:12:33 +01:00

sysctl.c

Sunrpc: Supports hexadecimal number for sysctl files of sunrpc debug

2015-11-03 15:56:49 -05:00

timer.c

…

xdr.c

SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()

2020-06-30 15:38:45 -04:00

xprt.c

SUNRPC: Fix a potential race in xprt_connect()

2018-12-21 14:11:36 +01:00

xprtmultipath.c

SUNRPC search xprt switch for sockaddr

2016-09-19 13:08:36 -04:00

xprtsock.c

sunrpc: safely reallow resvport min/max inversion

2019-11-28 18:28:31 +01:00