aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTrond Myklebust <trond.myklebust@primarydata.com>2015-02-11 17:27:55 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-03-06 14:43:29 -0800
commit5c88a9da64fccefe0374deae0ca806fec79b727e (patch)
treeffeec17926032327c306e27ce7cd673ae09c7a70
parent2c679cbba9e0c86d3b30072d95bc538adc4bc3d2 (diff)
downloadlinux-yocto-5c88a9da64fccefe0374deae0ca806fec79b727e.tar.gz
linux-yocto-5c88a9da64fccefe0374deae0ca806fec79b727e.tar.bz2
linux-yocto-5c88a9da64fccefe0374deae0ca806fec79b727e.zip
NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args
commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream. If the call to decode_rc_list() fails due to a memory allocation error, then we need to truncate the array size to ensure that we only call kfree() on those pointer that were allocated. Reported-by: David Ramos <daramos@stanford.edu> Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation") Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--fs/nfs/callback_xdr.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index f4ccfe6521ec..02f8d09e119f 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
for (i = 0; i < args->csa_nrclists; i++) {
status = decode_rc_list(xdr, &args->csa_rclists[i]);
- if (status)
+ if (status) {
+ args->csa_nrclists = i;
goto out_free;
+ }
}
}
status = 0;