| From c0cb8bf3a8e4bd82e640862cdd8891400405cb89 Mon Sep 17 00:00:00 2001 |
| From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Trnka?= <ttrnka@mail.muni.cz> |
| Date: Fri, 20 May 2016 16:41:10 +0200 |
| Subject: sunrpc: fix stripping of padded MIC tokens |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Tomáš Trnka <ttrnka@mail.muni.cz> |
| |
| commit c0cb8bf3a8e4bd82e640862cdd8891400405cb89 upstream. |
| |
| The length of the GSS MIC token need not be a multiple of four bytes. |
| It is then padded by XDR to a multiple of 4 B, but unwrap_integ_data() |
| would previously only trim mic.len + 4 B. The remaining up to three |
| bytes would then trigger a check in nfs4svc_decode_compoundargs(), |
| leading to a "garbage args" error and mount failure: |
| |
| nfs4svc_decode_compoundargs: compound not properly padded! |
| nfsd: failed to decode arguments! |
| |
| This would prevent older clients using the pre-RFC 4121 MIC format |
| (37-byte MIC including a 9-byte OID) from mounting exports from v3.9+ |
| servers using krb5i. |
| |
| The trimming was introduced by commit 4c190e2f913f ("sunrpc: trim off |
| trailing checksum before returning decrypted or integrity authenticated |
| buffer"). |
| |
| Fixes: 4c190e2f913f "unrpc: trim off trailing checksum..." |
| Signed-off-by: Tomáš Trnka <ttrnka@mail.muni.cz> |
| Acked-by: Jeff Layton <jlayton@poochiereds.net> |
| Signed-off-by: J. Bruce Fields <bfields@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/sunrpc/auth_gss/svcauth_gss.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/sunrpc/auth_gss/svcauth_gss.c |
| +++ b/net/sunrpc/auth_gss/svcauth_gss.c |
| @@ -855,8 +855,8 @@ unwrap_integ_data(struct svc_rqst *rqstp |
| goto out; |
| if (svc_getnl(&buf->head[0]) != seq) |
| goto out; |
| - /* trim off the mic at the end before returning */ |
| - xdr_buf_trim(buf, mic.len + 4); |
| + /* trim off the mic and padding at the end before returning */ |
| + xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4); |
| stat = 0; |
| out: |
| kfree(mic.data); |