Commit 72b19f30 authored by Trond Myklebust's avatar Trond Myklebust Committed by Greg Kroah-Hartman

NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args

commit d8ba1f97 upstream.

If the call to decode_rc_list() fails due to a memory allocation error,
then we need to truncate the array size to ensure that we only call
kfree() on those pointer that were allocated.
Reported-by: default avatarDavid Ramos <daramos@stanford.edu>
Fixes: 4aece6a1 ("nfs41: cb_sequence xdr implementation")
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c213da80
......@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
for (i = 0; i < args->csa_nrclists; i++) {
status = decode_rc_list(xdr, &args->csa_rclists[i]);
if (status)
if (status) {
args->csa_nrclists = i;
goto out_free;
}
}
}
status = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment