path: root/fs
diff options
authorTrond Myklebust <trond.myklebust@primarydata.com>2015-02-11 17:27:55 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-03-06 14:40:50 -0800
commit72b19f30985230979d812ae65a3fd4c28067a589 (patch)
tree8da9ae38e13a111f5836ae845fe2ff4f8feb3feb /fs
parentc213da80aa303730ca6d99a30f10043428c0e354 (diff)
NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args
commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream. If the call to decode_rc_list() fails due to a memory allocation error, then we need to truncate the array size to ensure that we only call kfree() on those pointer that were allocated. Reported-by: David Ramos <daramos@stanford.edu> Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation") Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index a35582c9d444..e98ecf8d2588 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
for (i = 0; i < args->csa_nrclists; i++) {
status = decode_rc_list(xdr, &args->csa_rclists[i]);
- if (status)
+ if (status) {
+ args->csa_nrclists = i;
goto out_free;
+ }
status = 0;