aboutsummaryrefslogtreecommitdiffstats
path: root/net/sunrpc
diff options
context:
space:
mode:
authorJ.Bruce Fields <bfields@fieldses.org>2006-12-13 03:35:19 -0500
committerLinus Torvalds <torvalds@woody.osdl.org>2006-12-13 12:05:53 -0500
commitb797b5beac966df5c5d96c0d39fe366f57135343 (patch)
tree2a7b84dc5d19def5b83497054515c915e82cce75 /net/sunrpc
parent451c11a161168fbdbba17573d4b062fdd2a4c2c4 (diff)
[PATCH] knfsd: svcrpc: fix gss krb5i memory leak
The memory leak here is embarassingly obvious. This fixes a problem that causes the kernel to leak a small amount of memory every time it receives a integrity-protected request. Thanks to Aim Le Rouzic for the bug report. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/sunrpc')
-rw-r--r--net/sunrpc/auth_gss/svcauth_gss.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 700353b330fd..3bf3520f92d1 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -804,19 +804,19 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
804 804
805 integ_len = svc_getnl(&buf->head[0]); 805 integ_len = svc_getnl(&buf->head[0]);
806 if (integ_len & 3) 806 if (integ_len & 3)
807 goto out; 807 return stat;
808 if (integ_len > buf->len) 808 if (integ_len > buf->len)
809 goto out; 809 return stat;
810 if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) 810 if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))
811 BUG(); 811 BUG();
812 /* copy out mic... */ 812 /* copy out mic... */
813 if (read_u32_from_xdr_buf(buf, integ_len, &mic.len)) 813 if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
814 BUG(); 814 BUG();
815 if (mic.len > RPC_MAX_AUTH_SIZE) 815 if (mic.len > RPC_MAX_AUTH_SIZE)
816 goto out; 816 return stat;
817 mic.data = kmalloc(mic.len, GFP_KERNEL); 817 mic.data = kmalloc(mic.len, GFP_KERNEL);
818 if (!mic.data) 818 if (!mic.data)
819 goto out; 819 return stat;
820 if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len)) 820 if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
821 goto out; 821 goto out;
822 maj_stat = gss_verify_mic(ctx, &integ_buf, &mic); 822 maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
@@ -826,6 +826,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
826 goto out; 826 goto out;
827 stat = 0; 827 stat = 0;
828out: 828out:
829 kfree(mic.data);
829 return stat; 830 return stat;
830} 831}
831 832