diff options
author | J.Bruce Fields <bfields@fieldses.org> | 2006-12-13 03:35:19 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.osdl.org> | 2006-12-13 12:05:53 -0500 |
commit | b797b5beac966df5c5d96c0d39fe366f57135343 (patch) | |
tree | 2a7b84dc5d19def5b83497054515c915e82cce75 /net/sunrpc | |
parent | 451c11a161168fbdbba17573d4b062fdd2a4c2c4 (diff) |
[PATCH] knfsd: svcrpc: fix gss krb5i memory leak
The memory leak here is embarassingly obvious.
This fixes a problem that causes the kernel to leak a small amount of memory
every time it receives a integrity-protected request.
Thanks to Aim Le Rouzic for the bug report.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/sunrpc')
-rw-r--r-- | net/sunrpc/auth_gss/svcauth_gss.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index 700353b330fd..3bf3520f92d1 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c | |||
@@ -804,19 +804,19 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx) | |||
804 | 804 | ||
805 | integ_len = svc_getnl(&buf->head[0]); | 805 | integ_len = svc_getnl(&buf->head[0]); |
806 | if (integ_len & 3) | 806 | if (integ_len & 3) |
807 | goto out; | 807 | return stat; |
808 | if (integ_len > buf->len) | 808 | if (integ_len > buf->len) |
809 | goto out; | 809 | return stat; |
810 | if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) | 810 | if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) |
811 | BUG(); | 811 | BUG(); |
812 | /* copy out mic... */ | 812 | /* copy out mic... */ |
813 | if (read_u32_from_xdr_buf(buf, integ_len, &mic.len)) | 813 | if (read_u32_from_xdr_buf(buf, integ_len, &mic.len)) |
814 | BUG(); | 814 | BUG(); |
815 | if (mic.len > RPC_MAX_AUTH_SIZE) | 815 | if (mic.len > RPC_MAX_AUTH_SIZE) |
816 | goto out; | 816 | return stat; |
817 | mic.data = kmalloc(mic.len, GFP_KERNEL); | 817 | mic.data = kmalloc(mic.len, GFP_KERNEL); |
818 | if (!mic.data) | 818 | if (!mic.data) |
819 | goto out; | 819 | return stat; |
820 | if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len)) | 820 | if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len)) |
821 | goto out; | 821 | goto out; |
822 | maj_stat = gss_verify_mic(ctx, &integ_buf, &mic); | 822 | maj_stat = gss_verify_mic(ctx, &integ_buf, &mic); |
@@ -826,6 +826,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx) | |||
826 | goto out; | 826 | goto out; |
827 | stat = 0; | 827 | stat = 0; |
828 | out: | 828 | out: |
829 | kfree(mic.data); | ||
829 | return stat; | 830 | return stat; |
830 | } | 831 | } |
831 | 832 | ||