Commit ce4a99ac authored Nov 30, 2018 by Chuck Lever Committed by Greg Kroah-Hartman Dec 13, 2018

SUNRPC: Fix leak of krb5p encode pages



commit 8dae5398ab1ac107b1517e8195ed043d5f422bd0 upstream.

call_encode can be invoked more than once per RPC call. Ensure that
each call to gss_wrap_req_priv does not overwrite pointers to
previously allocated memory.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 95e3e514

net/sunrpc/auth_gss/auth_gss.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -1736,6 +1736,7 @@ priv_release_snd_buf(struct rpc_rqst *rqstp)
		for (i=0; i < rqstp->rq_enc_pages_num; i++)
		__free_page(rqstp->rq_enc_pages[i]);
		kfree(rqstp->rq_enc_pages);
		rqstp->rq_release_snd_buf = NULL;
		}

		static int
		@@ -1744,6 +1745,9 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
		struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
		int first, last, i;

		if (rqstp->rq_release_snd_buf)
		rqstp->rq_release_snd_buf(rqstp);

		if (snd_buf->page_len == 0) {
		rqstp->rq_enc_pages_num = 0;
		return 0;