diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2021-03-02 10:48:38 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-04-07 12:04:20 +0200 |
| commit | 9e0b588e2f7630a18d22e10a478efc63b63aa269 (patch) | |
| tree | 3287c6f2a99cd1c734e694bd1884afef50d8f4d7 /lib/memory-notifier-error-inject.c | |
| parent | ef041934aeb69a5276856166d09cef73006b5a94 (diff) | |
rpc: fix NULL dereference on kmalloc failure
[ Upstream commit 0ddc942394013f08992fc379ca04cffacbbe3dae ]
I think this is unlikely but possible:
svc_authenticate sets rq_authop and calls svcauth_gss_accept. The
kmalloc(sizeof(*svcdata), GFP_KERNEL) fails, leaving rq_auth_data NULL,
and returning SVC_DENIED.
This causes svc_process_common to go to err_bad_auth, and eventually
call svc_authorise. That calls ->release == svcauth_gss_release, which
tries to dereference rq_auth_data.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Link: https://lore.kernel.org/linux-nfs/3F1B347F-B809-478F-A1E9-0BE98E22B0F0@oracle.com/T/#t
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'lib/memory-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions