Commit d8ba1f97 authored Feb 11, 2015 by Trond Myklebust

NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args



If the call to decode_rc_list() fails due to a memory allocation error,
then we need to truncate the array size to ensure that we only call
kfree() on those pointer that were allocated.

Reported-by: David Ramos <daramos@stanford.edu>
Fixes: 4aece6a1 ("nfs41: cb_sequence xdr implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>

parent c627d31b

fs/nfs/callback_xdr.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -464,10 +464,12 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,

		for (i = 0; i < args->csa_nrclists; i++) {
		status = decode_rc_list(xdr, &args->csa_rclists[i]);
		if (status)
		if (status) {
		args->csa_nrclists = i;
		goto out_free;
		}
		}
		}
		status = 0;

		dprintk("%s: sessionid %x:%x:%x:%x sequenceid %u slotid %u "