Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b932f081 authored by Daniel Kobras's avatar Daniel Kobras Committed by Greg Kroah-Hartman
Browse files

sunrpc: fix refcount leak for rpc auth modules 



commit f1442d6349a2e7bb7a6134791bdc26cb776c79af upstream.

If an auth module's accept op returns SVC_CLOSE, svc_process_common()
enters a call path that does not call svc_authorise() before leaving the
function, and thus leaks a reference on the auth module's refcount. Hence,
make sure calls to svc_authenticate() and svc_authorise() are paired for
all call paths, to make sure rpc auth modules can be unloaded.

Signed-off-by: default avatarDaniel Kobras <kobras@puzzle-itc.de>
Fixes: 4d712ef1db05 ("svcauth_gss: Close connection when dropping an incoming message")
Link: https://lore.kernel.org/linux-nfs/3F1B347F-B809-478F-A1E9-0BE98E22B0F0@oracle.com/T/#t


Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent edf3c31a

net/sunrpc/svc.c

+4 −2
Original line number Diff line number Diff line
@@ -1306,7 +1306,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) 


 sendit:

	if (svc_authorise(rqstp))

		goto close;

		goto close_xprt;

	return 1;		/* Caller can now send it */



 dropit:
@@ -1315,6 +1315,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) 
	return 0;



 close:

	svc_authorise(rqstp);

close_xprt:

	if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))

		svc_close_xprt(rqstp->rq_xprt);

	dprintk("svc: svc_process close\n");
@@ -1323,7 +1325,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) 
err_short_len:

	svc_printk(rqstp, "short len %Zd, dropping request\n",

			argv->iov_len);

	goto close;

	goto close_xprt;



err_bad_rpc:

	serv->sv_stats->rpcbadfmt++;