Commit 8a0fa3ff authored by Chuck Lever's avatar Chuck Lever Committed by Anna Schumaker
Browse files

SUNRPC: Fix crasher in gss_unwrap_resp_integ() 



If a zero length is passed to kmalloc() it returns 0x10, which is
not a valid address. gss_unwrap_resp_integ() subsequently crashes
when it attempts to dereference that pointer.

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent f5ea1613

net/sunrpc/auth_gss/auth_gss.c

+1 −1
Original line number Diff line number Diff line
@@ -1989,7 +1989,7 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred, 
		goto unwrap_failed;

	mic.len = len;

	mic.data = kmalloc(len, GFP_KERNEL);

	if (!mic.data)

	if (ZERO_OR_NULL_PTR(mic.data))

		goto unwrap_failed;

	if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))

		goto unwrap_failed;