Skip to content

Commit da522b5

Browse files
chuckleverChuck Lever
authored andcommitted
SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
Fixes: 030d794 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.") Signed-off-by: Chuck Lever <[email protected]> Cc: <[email protected]> Reviewed-by: Jeff Layton <[email protected]>
1 parent 638593b commit da522b5

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

net/sunrpc/auth_gss/svcauth_gss.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1162,18 +1162,23 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
11621162
return res;
11631163

11641164
inlen = svc_getnl(argv);
1165-
if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
1165+
if (inlen > (argv->iov_len + rqstp->rq_arg.page_len)) {
1166+
kfree(in_handle->data);
11661167
return SVC_DENIED;
1168+
}
11671169

11681170
pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
11691171
in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
1170-
if (!in_token->pages)
1172+
if (!in_token->pages) {
1173+
kfree(in_handle->data);
11711174
return SVC_DENIED;
1175+
}
11721176
in_token->page_base = 0;
11731177
in_token->page_len = inlen;
11741178
for (i = 0; i < pages; i++) {
11751179
in_token->pages[i] = alloc_page(GFP_KERNEL);
11761180
if (!in_token->pages[i]) {
1181+
kfree(in_handle->data);
11771182
gss_free_in_token_pages(in_token);
11781183
return SVC_DENIED;
11791184
}

0 commit comments

Comments
 (0)