SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache
authorTrond Myklebust <trond.myklebust@hammerspace.com>
Mon, 12 Nov 2018 20:30:52 +0000 (15:30 -0500)
committerTrond Myklebust <trond.myklebust@hammerspace.com>
Mon, 12 Nov 2018 21:39:13 +0000 (16:39 -0500)
commita652a4bc21695a57c3b8d13d222a6f8b41f100aa
tree6af76bd83128cde0a9992a5e223f377b72851bae
parenta1aa09be21fa344d1f5585aab8164bfae55f57e3
SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache

Commit 07d02a67b7fa causes a use-after free in the RPCSEC_GSS credential
destroy code, because the call to get_rpccred() in gss_destroying_context()
will now always fail to increment the refcount.

While we could just replace the get_rpccred() with a refcount_set(), that
would have the unfortunate consequence of resurrecting a credential in
the credential cache for which we are in the process of destroying the
RPCSEC_GSS context. Rather than do this, we choose to make a copy that
is never added to the cache and use that to destroy the context.

Fixes: 07d02a67b7fa ("SUNRPC: Simplify lookup code")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
net/sunrpc/auth_gss/auth_gss.c