Jim Chen has uploaded this change for review.
idmapper: prevent uid_cache UAF when looking up gss_princ entries by uname
Entries added to uname_tree with gss_princ == true have
in_uidtree == false and are not inserted into uid_tree. When
idmapper_lookup_by_uname() is subsequently called with
gss_princ == false and matches such an entry, it inserts
&found_user->uid_node into uid_cache without checking
found_user->in_uidtree. When remove_cache_user() later frees the
entry, it only clears uid_cache if user->in_uidtree is true, leaving a
dangling pointer in uid_cache that causes a use-after-free in
idmapper_lookup_by_uid().
Guard the uid_cache insertion in idmapper_lookup_by_uname() with
found_user->in_uidtree.
Change-Id: Id3b2ba5ca4450f12e40151a55a877264d8d6c310
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/idmapper/idmapper_cache.c
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/16/1256316/1
To view, visit change 1256316. To unsubscribe, or for help writing mail filters, visit settings.