Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b797b5be authored by J.Bruce Fields's avatar J.Bruce Fields Committed by Linus Torvalds
Browse files

[PATCH] knfsd: svcrpc: fix gss krb5i memory leak 



The memory leak here is embarassingly obvious.

This fixes a problem that causes the kernel to leak a small amount of memory
every time it receives a integrity-protected request.

Thanks to Aim Le Rouzic for the bug report.

Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 451c11a1

net/sunrpc/auth_gss/svcauth_gss.c

+5 −4
Original line number Diff line number Diff line
@@ -804,19 +804,19 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx) 


	integ_len = svc_getnl(&buf->head[0]);

	if (integ_len & 3)

		goto out;

		return stat;

	if (integ_len > buf->len)

		goto out;

		return stat;

	if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))

		BUG();

	/* copy out mic... */

	if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))

		BUG();

	if (mic.len > RPC_MAX_AUTH_SIZE)

		goto out;

		return stat;

	mic.data = kmalloc(mic.len, GFP_KERNEL);

	if (!mic.data)

		goto out;

		return stat;

	if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))

		goto out;

	maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
@@ -826,6 +826,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx) 
		goto out;

	stat = 0;

out:

	kfree(mic.data);

	return stat;

}