Skip to content

Commit 8a0fa3f

Browse files
chuckleveramschuma-ntap
authored andcommitted
SUNRPC: Fix crasher in gss_unwrap_resp_integ()
If a zero length is passed to kmalloc() it returns 0x10, which is not a valid address. gss_unwrap_resp_integ() subsequently crashes when it attempts to dereference that pointer. Signed-off-by: Chuck Lever <[email protected]> Signed-off-by: Anna Schumaker <[email protected]>
1 parent f5ea161 commit 8a0fa3f

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

net/sunrpc/auth_gss/auth_gss.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1989,7 +1989,7 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
19891989
goto unwrap_failed;
19901990
mic.len = len;
19911991
mic.data = kmalloc(len, GFP_KERNEL);
1992-
if (!mic.data)
1992+
if (ZERO_OR_NULL_PTR(mic.data))
19931993
goto unwrap_failed;
19941994
if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
19951995
goto unwrap_failed;

0 commit comments

Comments
 (0)