[ciqlts9_4] sunrpc: handle SVC_GARBAGE during svc auth processing as auth error #396
+2
−8
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR changes the handling of SVC_GARBAGE in svc_process_common so that it is treated as an authentication error (AUTH_BADCRED) rather than returning GARBAGE_ARGS, in order to avoid dereferencing a null rq_accept_statp and to comply with RFC 5531.
- Replace
err_garbage_argspath with settingrq_auth_stat = rpc_autherr_badcredand jumping toerr_bad_auth. - Remove the old
err_garbage_argslabel block and its stats/log updates. - Ensure crashes from malformed packets no longer occur by sidestepping
rq_accept_statp.
Comments suppressed due to low confidence (2)
net/sunrpc/svc.c:1345
- [nitpick] Consider updating or adding a comment above this case to note that
SVC_GARBAGEnow maps to an auth error (AUTH_BADCRED) per RFC 5531, replacing the old garbage-args behavior.
case SVC_GARBAGE:
net/sunrpc/svc.c:1346
- Add a kselftest or integration test that triggers the
SVC_GARBAGEpath to verify the request is rejected withAUTH_BADCREDinstead ofGARBAGE_ARGS.
rqstp->rq_auth_stat = rpc_autherr_badcred;
shreeya-patel98
requested review from
jainanmol84,
PlaidCat,
bmastbergen and
thefossguy-ciq
jira VULN-71607 cve CVE-2025-38089 commit-author Jeff Layton <jlayton@kernel.org> commit 94d10a4 upstream-diff A merge conflict was caused because the following commit doesn't exit in our tree: ab42f4d ("sunrpc: don't change ->sv_stats if it doesn't exist") tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash. Cc: stable@kernel.org Fixes: 29cd292 ("SUNRPC: Fix encoding of accepted but unsuccessful RPC replies") Reported-by: tianshuo han <hantianshuo233@gmail.com> Reviewed-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> (cherry picked from commit 94d10a4) Signed-off-by: Shreeya Patel <spatel@ciq.com>
shreeya-patel98
force-pushed
the
{spatel}_ciqlts9_4
branch
from
c1e3b00 to
dac1ecc
Compare
thefossguy-ciq
approved these changes
Jul 8, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Commit message
Kernel build logs
kernel-build.log
Kselftests
kselftest-before.log
kselftest-after.log