[rpms/gdm] f44: Backport MR #391 to fix auto-login regression (RHBZ #2517317)

[rpms/gdm] f44: Backport MR #391 to fix auto-login regression (RHBZ #2517317)

[Adam Williamson]

A new commit has been pushed.

Repo   : rpms/gdm
Branch : f44
Commit : 1ae21d6b6ecdb1dcaa00573ca892091f08f07a11
Author : Adam Williamson <awilliam@redhat.com>
Date   : 2026-08-31T12:18:25-07:00
Stats  : +63/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/gdm/c/1ae21d6b6ecdb1dcaa00573ca892091f08f07a11?branch=f44

Log:
Backport MR #391 to fix auto-login regression (RHBZ #2517317)

---
diff --git a/0001-pam_gdm-Don-t-reject-unterminated-buffers.patch b/0001-pam_gdm-Don-t-reject-unterminated-buffers.patch
new file mode 100644
index 0000000..129ab58
--- /dev/null
+++ b/0001-pam_gdm-Don-t-reject-unterminated-buffers.patch
@@ -0,0 +1,55 @@
+From fc958fa6546ca6ea0112dd1651cf85bea14d8122 Mon Sep 17 00:00:00 2001
+From: Adrian Vovk <adrianvovk@gmail.com>
+Date: Thu, 13 Aug 2026 16:29:01 -0400
+Subject: [PATCH] pam_gdm: Don't reject unterminated buffers
+
+The data returned by the kernel keyring is a list of strings separated
+by their null terminators. However, the might not be a terminator on the
+very end
+
+Previously we were using strlen(), which meant we could read past the
+end of the array. A previous security patch was a little overzealous,
+and rather than just fixing the strlen() call it _also_ completely
+rejected unterminated buffers.
+
+However, systemd _intentionally_ does not terminate the buffer when it
+creates it. This means that, after this security patch, pam_gdm
+basically stopped working. Let's fix the regression but keep the
+underlying bugfix
+
+Fixes: 4ecd58d766840835598e5b6c63088460dba6ac4d
+
+Closes: https://gitlab.gnome.org/GNOME/gdm/-/work_items/1090
+Part-of: <https://gitlab.gnome.org/GNOME/gdm/-/merge_requests/391>
+---
+ pam_gdm/pam_gdm.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/pam_gdm/pam_gdm.c b/pam_gdm/pam_gdm.c
+index a7351c28c..310feabdc 100644
+--- a/pam_gdm/pam_gdm.c
++++ b/pam_gdm/pam_gdm.c
+@@ -67,20 +67,6 @@ pam_sm_authenticate (pam_handle_t  *pamh,
+                 return PAM_AUTHINFO_UNAVAIL;
+ 
+         cached_passwords_length = r;
+-
+-        /*
+-            The payload is a NUL-separated list of passwords, but the blob
+-            returned by the kernel is not guaranteed to be NUL-terminated.
+-            Reject a payload whose final entry is not terminated within the
+-            buffer so that walking it below cannot read past the end.
+-        */
+-        if (cached_passwords_length == 0 ||
+-            ((char *) cached_passwords)[cached_passwords_length - 1] != '\0') {
+-                gdm_pam_zero_buffer (cached_passwords, cached_passwords_length);
+-                free (cached_passwords);
+-                return PAM_AUTHINFO_UNAVAIL;
+-        }
+-
+         /*
+             Find the last password in the NUL-separated list of passwords.
+             Multiple passwords are returned either when the user enters an
+-- 
+2.55.0
+

diff --git a/gdm.spec b/gdm.spec
index 41a08dc..86f8b58 100644
--- a/gdm.spec
+++ b/gdm.spec
@@ -25,6 +25,14 @@ Source0:        https://download.gnome.org/sources/gdm/%{major_version}/gdm-%{ta
 Source1:        org.gnome.login-screen.gschema.override
 Source2:        gdm.sysusers
 
+# Upstream patches
+# https://gitlab.gnome.org/GNOME/gdm/-/work_items/1090
+# https://bugzilla.redhat.com/show_bug.cgi?id=2517317
+# https://gitlab.gnome.org/GNOME/gdm/-/merge_requests/391
+# pam_gdm: Don't reject unterminated buffers
+# Fixes auto-login regression
+Patch:          0001-pam_gdm-Don-t-reject-unterminated-buffers.patch
+
 # Downstream patches
 Patch:          0001-Honor-initial-setup-being-disabled-by-distro-install.patch
 Patch:          0001-data-add-system-dconf-databases-to-gdm-profile.patch