1 files changed, 11 insertions, 5 deletions

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f7a7f8380e38..c389ccf6437d 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -206,8 +206,14 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
         ctx->gc_win = window_size;
         /* gssd signals an error by passing ctx->gc_win = 0: */
         if (ctx->gc_win == 0) {
-                /* in which case, p points to  an error code which we ignore */
-                p = ERR_PTR(-EACCES);
+                /*
+                 * in which case, p points to an error code. Anything other
+                 * than -EKEYEXPIRED gets converted to -EACCES.
+                 */
+                p = simple_get_bytes(p, end, &ret, sizeof(ret));
+                if (!IS_ERR(p))
+                        p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
+                                                    ERR_PTR(-EACCES);
                 goto err;
         }
         /* copy the opaque wire context */
@@ -646,6 +652,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
                 err = PTR_ERR(p);
                 switch (err) {
                 case -EACCES:
+                case -EKEYEXPIRED:
                         gss_msg->msg.errno = err;
                         err = mlen;
                         break;
@@ -1273,9 +1280,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
         rqstp->rq_release_snd_buf = priv_release_snd_buf;
         return 0;
 out_free:
-        for (i--; i >= 0; i--) {
-                __free_page(rqstp->rq_enc_pages[i]);
-        }
+        rqstp->rq_enc_pages_num = i;
+        priv_release_snd_buf(rqstp);
 out:
         return -EAGAIN;
 }