• Martijn de Gouw's avatar
    SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() · d48c8124
    Martijn de Gouw authored
    When the passed token is longer than 4032 bytes, the remaining part
    of the token must be copied from the rqstp->rq_arg.pages. But the
    copy must make sure it happens in a consecutive way.
    
    With the existing code, the first memcpy copies 'length' bytes from
    argv->iobase, but since the header is in front, this never fills the
    whole first page of in_token->pages.
    
    The mecpy in the loop copies the following bytes, but starts writing at
    the next page of in_token->pages.  This leaves the last bytes of page 0
    unwritten.
    
    Symptoms were that users with many groups were not able to access NFS
    exports, when using Active Directory as the KDC.
    Signed-off-by: default avatarMartijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
    Fixes: 5866efa8 "SUNRPC: Fix svcauth_gss_proxy_init()"
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    d48c8124
svcauth_gss.c 49.1 KB