[PATCH] groups_alloc(0) clobbers memory past end of block

From: Olaf Kirch <okir@suse.de>

Authentication code in net/sunrpc makes frequent use of groups_alloc(0),
which seems to clobber memory past the end of what it allocated.

If called with gidsetsize == 0, groups_alloc will set nblocks = 0,
but still does a

	group_info->blocks[0] = group_info->small_block;

kernel/sys.c

@@ -1125,8 +1125,7 @@ struct group_info *groups_alloc(int gidsetsize)
 	int nblocks;
 	int i;
 
-	nblocks = (gidsetsize/NGROUPS_PER_BLOCK) +
-	    (gidsetsize%NGROUPS_PER_BLOCK?1:0);
+	nblocks = (gidsetsize + NGROUPS_PER_BLOCK - 1) / NGROUPS_PER_BLOCK;
 	group_info = kmalloc(sizeof(*group_info) + nblocks*sizeof(gid_t *),
 	    GFP_USER);
 	if (!group_info)