Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aa91afe5 authored by Chuck Lever's avatar Chuck Lever Committed by Greg Kroah-Hartman
Browse files

SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails 



commit da522b5fe1a5f8b7c20a0023e87b52a150e53bf5 upstream.

Fixes: 030d794b ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.")
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e027f3b9

net/sunrpc/auth_gss/svcauth_gss.c

+7 −2
Original line number Diff line number Diff line
@@ -1104,18 +1104,23 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp, 
		return res;



	inlen = svc_getnl(argv);

	if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))

	if (inlen > (argv->iov_len + rqstp->rq_arg.page_len)) {

		kfree(in_handle->data);

		return SVC_DENIED;

	}



	pages = DIV_ROUND_UP(inlen, PAGE_SIZE);

	in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);

	if (!in_token->pages)

	if (!in_token->pages) {

		kfree(in_handle->data);

		return SVC_DENIED;

	}

	in_token->page_base = 0;

	in_token->page_len = inlen;

	for (i = 0; i < pages; i++) {

		in_token->pages[i] = alloc_page(GFP_KERNEL);

		if (!in_token->pages[i]) {

			kfree(in_handle->data);

			gss_free_in_token_pages(in_token);

			return SVC_DENIED;

		}