Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1256316?usp=email ) Change subject: idmapper: prevent uid_cache UAF when looking up gss_princ entries by uname ...................................................................... idmapper: prevent uid_cache UAF when looking up gss_princ entries by uname Entries added to uname_tree with gss_princ == true have in_uidtree == false and are not inserted into uid_tree. When idmapper_lookup_by_uname() is subsequently called with gss_princ == false and matches such an entry, it inserts &found_user->uid_node into uid_cache without checking found_user->in_uidtree. When remove_cache_user() later frees the entry, it only clears uid_cache if user->in_uidtree is true, leaving a dangling pointer in uid_cache that causes a use-after-free in idmapper_lookup_by_uid(). Guard the uid_cache insertion in idmapper_lookup_by_uname() with found_user->in_uidtree. Change-Id: Id3b2ba5ca4450f12e40151a55a877264d8d6c310 Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/idmapper/idmapper_cache.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/16/1256316/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1256316?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Id3b2ba5ca4450f12e40151a55a877264d8d6c310 Gerrit-Change-Number: 1256316 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>