[Midnightbsd-cvs] src [8566] trunk/sys/kgssapi: invalid kgss_gssd_handle crash
laffer1 at midnightbsd.org
laffer1 at midnightbsd.org
Mon Sep 19 11:22:53 EDT 2016
Revision: 8566
http://svnweb.midnightbsd.org/src/?rev=8566
Author: laffer1
Date: 2016-09-19 11:22:52 -0400 (Mon, 19 Sep 2016)
Log Message:
-----------
invalid kgss_gssd_handle crash
Modified Paths:
--------------
trunk/sys/kgssapi/gss_accept_sec_context.c
trunk/sys/kgssapi/gss_acquire_cred.c
trunk/sys/kgssapi/gss_canonicalize_name.c
trunk/sys/kgssapi/gss_delete_sec_context.c
trunk/sys/kgssapi/gss_display_status.c
trunk/sys/kgssapi/gss_export_name.c
trunk/sys/kgssapi/gss_impl.c
trunk/sys/kgssapi/gss_import_name.c
trunk/sys/kgssapi/gss_init_sec_context.c
trunk/sys/kgssapi/gss_pname_to_uid.c
trunk/sys/kgssapi/gss_release_cred.c
trunk/sys/kgssapi/gss_release_name.c
trunk/sys/kgssapi/gss_set_cred_option.c
trunk/sys/kgssapi/gssapi_impl.h
Modified: trunk/sys/kgssapi/gss_accept_sec_context.c
===================================================================
--- trunk/sys/kgssapi/gss_accept_sec_context.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_accept_sec_context.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -58,9 +60,13 @@
gss_ctx_id_t ctx = *context_handle;
gss_name_t name;
gss_cred_id_t cred;
+ CLIENT *cl;
- if (!kgss_gssd_handle)
+ cl = kgss_gssd_client();
+ if (cl == NULL) {
+ *minor_status = 0;
return (GSS_S_FAILURE);
+ }
if (ctx)
args.ctx = ctx->handle;
@@ -74,7 +80,8 @@
args.input_chan_bindings = input_chan_bindings;
bzero(&res, sizeof(res));
- stat = gssd_accept_sec_context_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_accept_sec_context_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
Modified: trunk/sys/kgssapi/gss_acquire_cred.c
===================================================================
--- trunk/sys/kgssapi/gss_acquire_cred.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_acquire_cred.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <sys/proc.h>
#include <kgssapi/gssapi.h>
@@ -55,8 +57,11 @@
enum clnt_stat stat;
gss_cred_id_t cred;
int i;
+ CLIENT *cl;
- if (!kgss_gssd_handle)
+ *minor_status = 0;
+ cl = kgss_gssd_client();
+ if (cl == NULL)
return (GSS_S_FAILURE);
args.uid = curthread->td_ucred->cr_uid;
@@ -69,7 +74,8 @@
args.cred_usage = cred_usage;
bzero(&res, sizeof(res));
- stat = gssd_acquire_cred_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_acquire_cred_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -80,7 +86,6 @@
return (res.major_status);
}
- *minor_status = 0;
cred = malloc(sizeof(struct _gss_cred_id_t), M_GSSAPI, M_WAITOK);
cred->handle = res.output_cred;
*output_cred_handle = cred;
Modified: trunk/sys/kgssapi/gss_canonicalize_name.c
===================================================================
--- trunk/sys/kgssapi/gss_canonicalize_name.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_canonicalize_name.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -48,8 +50,11 @@
struct canonicalize_name_args args;
enum clnt_stat stat;
gss_name_t name;
+ CLIENT *cl;
- if (!kgss_gssd_handle)
+ *minor_status = 0;
+ cl = kgss_gssd_client();
+ if (cl == NULL)
return (GSS_S_FAILURE);
args.input_name = input_name->handle;
@@ -56,7 +61,8 @@
args.mech_type = mech_type;
bzero(&res, sizeof(res));
- stat = gssd_canonicalize_name_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_canonicalize_name_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -69,7 +75,6 @@
name = malloc(sizeof(struct _gss_name_t), M_GSSAPI, M_WAITOK);
name->handle = res.output_name;
- *minor_status = 0;
*output_name = name;
return (GSS_S_COMPLETE);
Modified: trunk/sys/kgssapi/gss_delete_sec_context.c
===================================================================
--- trunk/sys/kgssapi/gss_delete_sec_context.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_delete_sec_context.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -46,7 +48,10 @@
struct delete_sec_context_args args;
enum clnt_stat stat;
gss_ctx_id_t ctx;
+ CLIENT *cl;
+ *minor_status = 0;
+
if (!kgss_gssd_handle)
return (GSS_S_FAILURE);
@@ -60,9 +65,13 @@
*/
if (ctx->handle) {
args.ctx = ctx->handle;
+ cl = kgss_gssd_client();
+ if (cl == NULL)
+ return (GSS_S_FAILURE);
bzero(&res, sizeof(res));
- stat = gssd_delete_sec_context_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_delete_sec_context_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -85,7 +94,5 @@
}
}
- *minor_status = 0;
-
return (GSS_S_COMPLETE);
}
Modified: trunk/sys/kgssapi/gss_display_status.c
===================================================================
--- trunk/sys/kgssapi/gss_display_status.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_display_status.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -49,8 +51,11 @@
struct display_status_res res;
struct display_status_args args;
enum clnt_stat stat;
+ CLIENT *cl;
- if (!kgss_gssd_handle)
+ *minor_status = 0;
+ cl = kgss_gssd_client();
+ if (cl == NULL)
return (GSS_S_FAILURE);
args.status_value = status_value;
@@ -59,7 +64,8 @@
args.message_context = *message_context;
bzero(&res, sizeof(res));
- stat = gssd_display_status_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_display_status_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -70,7 +76,6 @@
return (res.major_status);
}
- *minor_status = 0;
*message_context = res.message_context;
kgss_copy_buffer(&res.status_string, status_string);
xdr_free((xdrproc_t) xdr_display_status_res, &res);
Modified: trunk/sys/kgssapi/gss_export_name.c
===================================================================
--- trunk/sys/kgssapi/gss_export_name.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_export_name.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -45,14 +47,18 @@
struct export_name_res res;
struct export_name_args args;
enum clnt_stat stat;
+ CLIENT *cl;
- if (!kgss_gssd_handle)
+ *minor_status = 0;
+ cl = kgss_gssd_client();
+ if (cl == NULL)
return (GSS_S_FAILURE);
args.input_name = input_name->handle;
bzero(&res, sizeof(res));
- stat = gssd_export_name_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_export_name_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -63,7 +69,6 @@
return (res.major_status);
}
- *minor_status = 0;
kgss_copy_buffer(&res.exported_name, exported_name);
xdr_free((xdrproc_t) xdr_export_name_res, &res);
Modified: trunk/sys/kgssapi/gss_impl.c
===================================================================
--- trunk/sys/kgssapi/gss_impl.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_impl.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,8 +31,10 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
#include <sys/module.h>
+#include <sys/mutex.h>
#include <sys/priv.h>
#include <sys/syscall.h>
#include <sys/sysent.h>
@@ -59,6 +61,7 @@
struct kgss_mech_list kgss_mechs;
CLIENT *kgss_gssd_handle;
+struct mtx kgss_gssd_lock;
static void
kgss_init(void *dummy)
@@ -92,14 +95,12 @@
struct netconfig *nconf;
char path[MAXPATHLEN];
int error;
+ CLIENT *cl, *oldcl;
error = priv_check(td, PRIV_NFS_DAEMON);
if (error)
return (error);
- if (kgss_gssd_handle)
- CLNT_DESTROY(kgss_gssd_handle);
-
error = copyinstr(uap->path, path, sizeof(path), NULL);
if (error)
return (error);
@@ -109,10 +110,20 @@
sun.sun_len = SUN_LEN(&sun);
nconf = getnetconfigent("local");
- kgss_gssd_handle = clnt_reconnect_create(nconf,
+ cl = clnt_reconnect_create(nconf,
(struct sockaddr *) &sun, GSSD, GSSDVERS,
RPC_MAXDATASIZE, RPC_MAXDATASIZE);
+ mtx_lock(&kgss_gssd_lock);
+ oldcl = kgss_gssd_handle;
+ kgss_gssd_handle = cl;
+ mtx_unlock(&kgss_gssd_lock);
+
+ if (oldcl != NULL) {
+ CLNT_CLOSE(oldcl);
+ CLNT_RELEASE(oldcl);
+ }
+
return (0);
}
@@ -249,6 +260,23 @@
}
/*
+ * Acquire the kgss_gssd_handle and return it with a reference count,
+ * if it is available.
+ */
+CLIENT *
+kgss_gssd_client(void)
+{
+ CLIENT *cl;
+
+ mtx_lock(&kgss_gssd_lock);
+ cl = kgss_gssd_handle;
+ if (cl != NULL)
+ CLNT_ACQUIRE(cl);
+ mtx_unlock(&kgss_gssd_lock);
+ return (cl);
+}
+
+/*
* Kernel module glue
*/
static int
@@ -280,6 +308,7 @@
rpc_gss_get_principal_name;
rpc_gss_entries.rpc_gss_svc_max_data_length =
rpc_gss_svc_max_data_length;
+ mtx_init(&kgss_gssd_lock, "kgss_gssd_lock", NULL, MTX_DEF);
break;
case MOD_UNLOAD:
/*
Modified: trunk/sys/kgssapi/gss_import_name.c
===================================================================
--- trunk/sys/kgssapi/gss_import_name.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_import_name.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -48,11 +50,13 @@
struct import_name_args args;
enum clnt_stat stat;
gss_name_t name;
+ CLIENT *cl;
*minor_status = 0;
*output_name = GSS_C_NO_NAME;
- if (!kgss_gssd_handle)
+ cl = kgss_gssd_client();
+ if (cl == NULL)
return (GSS_S_FAILURE);
args.input_name_buffer = *input_name_buffer;
@@ -59,7 +63,8 @@
args.input_name_type = input_name_type;
bzero(&res, sizeof(res));
- stat = gssd_import_name_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_import_name_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
Modified: trunk/sys/kgssapi/gss_init_sec_context.c
===================================================================
--- trunk/sys/kgssapi/gss_init_sec_context.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_init_sec_context.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <sys/proc.h>
#include <kgssapi/gssapi.h>
@@ -60,10 +62,12 @@
struct init_sec_context_args args;
enum clnt_stat stat;
gss_ctx_id_t ctx = *context_handle;
+ CLIENT *cl;
*minor_status = 0;
- if (!kgss_gssd_handle)
+ cl = kgss_gssd_client();
+ if (cl == NULL)
return (GSS_S_FAILURE);
args.uid = curthread->td_ucred->cr_uid;
@@ -88,7 +92,8 @@
}
bzero(&res, sizeof(res));
- stat = gssd_init_sec_context_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_init_sec_context_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
Modified: trunk/sys/kgssapi/gss_pname_to_uid.c
===================================================================
--- trunk/sys/kgssapi/gss_pname_to_uid.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_pname_to_uid.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -45,20 +47,23 @@
struct pname_to_uid_res res;
struct pname_to_uid_args args;
enum clnt_stat stat;
+ CLIENT *cl;
*minor_status = 0;
- if (!kgss_gssd_handle)
- return (GSS_S_FAILURE);
-
if (pname == GSS_C_NO_NAME)
return (GSS_S_BAD_NAME);
+ cl = kgss_gssd_client();
+ if (cl == NULL)
+ return (GSS_S_FAILURE);
+
args.pname = pname->handle;
args.mech = mech;
bzero(&res, sizeof(res));
- stat = gssd_pname_to_uid_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_pname_to_uid_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -83,20 +88,23 @@
struct pname_to_uid_args args;
enum clnt_stat stat;
int i, n;
+ CLIENT *cl;
*minor_status = 0;
- if (!kgss_gssd_handle)
- return (GSS_S_FAILURE);
-
if (pname == GSS_C_NO_NAME)
return (GSS_S_BAD_NAME);
+ cl = kgss_gssd_client();
+ if (cl == NULL)
+ return (GSS_S_FAILURE);
+
args.pname = pname->handle;
args.mech = mech;
bzero(&res, sizeof(res));
- stat = gssd_pname_to_uid_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_pname_to_uid_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
Modified: trunk/sys/kgssapi/gss_release_cred.c
===================================================================
--- trunk/sys/kgssapi/gss_release_cred.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_release_cred.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -44,13 +46,21 @@
struct release_cred_res res;
struct release_cred_args args;
enum clnt_stat stat;
+ CLIENT *cl;
+ *minor_status = 0;
+
if (!kgss_gssd_handle)
return (GSS_S_FAILURE);
if (*cred_handle) {
args.cred = (*cred_handle)->handle;
- stat = gssd_release_cred_1(&args, &res, kgss_gssd_handle);
+
+ cl = kgss_gssd_client();
+ if (cl == NULL)
+ return (GSS_S_FAILURE);
+ stat = gssd_release_cred_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -63,7 +73,5 @@
return (res.major_status);
}
- *minor_status = 0;
-
return (GSS_S_COMPLETE);
}
Modified: trunk/sys/kgssapi/gss_release_name.c
===================================================================
--- trunk/sys/kgssapi/gss_release_name.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_release_name.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -45,7 +47,10 @@
struct release_name_args args;
enum clnt_stat stat;
gss_name_t name;
+ CLIENT *cl;
+ *minor_status = 0;
+
if (!kgss_gssd_handle)
return (GSS_S_FAILURE);
@@ -53,7 +58,11 @@
name = *input_name;
args.input_name = name->handle;
- stat = gssd_release_name_1(&args, &res, kgss_gssd_handle);
+ cl = kgss_gssd_client();
+ if (cl == NULL)
+ return (GSS_S_FAILURE);
+ stat = gssd_release_name_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
return (GSS_S_FAILURE);
@@ -68,7 +77,5 @@
}
}
- *minor_status = 0;
-
return (GSS_S_COMPLETE);
}
Modified: trunk/sys/kgssapi/gss_set_cred_option.c
===================================================================
--- trunk/sys/kgssapi/gss_set_cred_option.c 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gss_set_cred_option.c 2016-09-19 15:22:52 UTC (rev 8566)
@@ -31,7 +31,9 @@
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
+#include <sys/lock.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>
@@ -47,10 +49,12 @@
struct set_cred_option_res res;
struct set_cred_option_args args;
enum clnt_stat stat;
+ CLIENT *cl;
*minor_status = 0;
- if (!kgss_gssd_handle)
+ cl = kgss_gssd_client();
+ if (cl == NULL)
return (GSS_S_FAILURE);
if (cred)
@@ -61,7 +65,8 @@
args.option_value = *option_value;
bzero(&res, sizeof(res));
- stat = gssd_set_cred_option_1(&args, &res, kgss_gssd_handle);
+ stat = gssd_set_cred_option_1(&args, &res, cl);
+ CLNT_RELEASE(cl);
if (stat != RPC_SUCCESS) {
*minor_status = stat;
Modified: trunk/sys/kgssapi/gssapi_impl.h
===================================================================
--- trunk/sys/kgssapi/gssapi_impl.h 2016-09-19 15:22:28 UTC (rev 8565)
+++ trunk/sys/kgssapi/gssapi_impl.h 2016-09-19 15:22:52 UTC (rev 8566)
@@ -53,8 +53,10 @@
LIST_HEAD(kgss_mech_list, kgss_mech);
extern CLIENT *kgss_gssd_handle;
+extern struct mtx kgss_gssd_lock;
extern struct kgss_mech_list kgss_mechs;
+CLIENT *kgss_gssd_client(void);
int kgss_oid_equal(const gss_OID oid1, const gss_OID oid2);
extern void kgss_install_mech(gss_OID mech_type, const char *name,
struct kobj_class *cls);
More information about the Midnightbsd-cvs
mailing list