• David Ramos's avatar
    svcrpc: fix memory leak in gssp_accept_sec_context_upcall · a1d1e9be
    David Ramos authored
    Our UC-KLEE tool found a kernel memory leak of 512 bytes (on x86_64) for
    each call to gssp_accept_sec_context_upcall()
    (net/sunrpc/auth_gss/gss_rpc_upcall.c). Since it appears that this call
    can be triggered by remote connections (at least, from a cursory a
    glance at the call chain), it may be exploitable to cause kernel memory
    exhaustion. We found the bug in kernel 3.16.3, but it appears to date
    back to commit 9dfd87da (2013-08-20).
    
    The gssp_accept_sec_context_upcall() function performs a pair of calls
    to gssp_alloc_receive_pages() and gssp_free_receive_pages().  The first
    allocates memory for arg->pages.  The second then frees the pages
    pointed to by the arg->pages array, but not the array itself.
    Reported-by: default avatarDavid A. Ramos <daramos@stanford.edu>
    Fixes: 9dfd87da ("rpc: fix huge kmalloc's in gss-proxy”)
    Signed-off-by: default avatarDavid A. Ramos <daramos@stanford.edu>
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    a1d1e9be
gss_rpc_upcall.c 9.38 KB