Skip to contentSkip to conversation

FAILED: patch "[PATCH] SUNRPC: Don't leak netobj memory when gss_read_proxy_verf()" failed to apply to 4.9-stable tree

PATCH [email protected] 1 participant 1 message Jan 2, 2023

Subsystems (4)
Networking Stable branch NFS client NFS server
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

Possible dependencies:

da522b5fe1a5 ("SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails") 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From da522b5fe1a5f8b7c20a0023e87b52a150e53bf5 Mon Sep 17 00:00:00 2001
From: Chuck Lever <[email protected]>
Date: Sat, 26 Nov 2022 15:55:18 -0500
Subject: [PATCH] SUNRPC: Don't leak netobj memory when gss_read_proxy_verf()
fails

Fixes 030d794bf498 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.")
Signed-off-by Chuck Lever <[email protected]>
Cc <[email protected]>
Reviewed-by Jeff Layton <[email protected]>
net/sunrpc/auth_gss/svcauth_gss.c +7 -2
index bcd74dddbe2d..9a5db285d4ae 100644
@@ -1162,18 +1162,23 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
 		return res;
 
 	inlen = svc_getnl(argv);
-	if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
+	if (inlen > (argv->iov_len + rqstp->rq_arg.page_len)) {
+		kfree(in_handle->data);
 		return SVC_DENIED;
+	}
 
 	pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
 	in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
-	if (!in_token->pages)
+	if (!in_token->pages) {
+		kfree(in_handle->data);
 		return SVC_DENIED;
+	}
 	in_token->page_base = 0;
 	in_token->page_len = inlen;
 	for (i = 0; i < pages; i++) {
 		in_token->pages[i] = alloc_page(GFP_KERNEL);
 		if (!in_token->pages[i]) {
+			kfree(in_handle->data);
 			gss_free_in_token_pages(in_token);
 			return SVC_DENIED;
 		}