Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f85592f4 authored by J. Bruce Fields's avatar J. Bruce Fields Committed by Greg Kroah-Hartman
Browse files

sunrpc: handle ENOMEM in rpcb_getport_async 



commit 81c88b18de1f11f70c97f28ced8d642c00bb3955 upstream.

If we ignore the error we'll hit a null dereference a little later.

Reported-by: default avatar <syzbot+4b98281f2401ab849f4b@syzkaller.appspotmail.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent eb376a62

net/sunrpc/rpcb_clnt.c

+8 −0
Original line number Diff line number Diff line
@@ -771,6 +771,12 @@ void rpcb_getport_async(struct rpc_task *task) 
	case RPCBVERS_3:

		map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID];

		map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC);

		if (!map->r_addr) {

			status = -ENOMEM;

			dprintk("RPC: %5u %s: no memory available\n",

				task->tk_pid, __func__);

			goto bailout_free_args;

		}

		map->r_owner = "";

		break;

	case RPCBVERS_2:
@@ -793,6 +799,8 @@ void rpcb_getport_async(struct rpc_task *task) 
	rpc_put_task(child);

	return;



bailout_free_args:

	kfree(map);

bailout_release_client:

	rpc_release_client(rpcb_clnt);

bailout_nofree: