svcrpc: fix gss-proxy xdr decoding oops

Uninitialized stack data was being used as the destination for memcpy's.

Longer term we'll just delete some of this code; all we're doing is
skipping over xdr that we don't care about.

Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index 357f613df7ff..3c85d1c8a028 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
 static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
                                     struct gssx_name_attr_array *naa)
 {
-        struct gssx_name_attr dummy;
+        struct gssx_name_attr dummy = { .attr = {.len = 0} };
         u32 count, i;
         __be32 *p;
 
@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
         return err;
 }
 
+
 static int gssx_dec_name(struct xdr_stream *xdr,
                          struct gssx_name *name)
 {
-        struct xdr_netobj dummy_netobj;
-        struct gssx_name_attr_array dummy_name_attr_array;
-        struct gssx_option_array dummy_option_array;
+        struct xdr_netobj dummy_netobj = { .len = 0 };
+        struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
+        struct gssx_option_array dummy_option_array = { .count = 0 };
         int err;
 
         /* name->display_name */