diff options
| author | Daniel Kobras <kobras@puzzle-itc.de> | 2021-02-27 00:04:37 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-03-24 11:05:01 +0100 |
| commit | a1507d7f825dd45758f569c340a3b2fc7bfb5220 (patch) | |
| tree | 891be572052493760eecbe300e13068adbc6a419 | |
| parent | 28e89394dde121a05ef2139d85eaf4fe54018a96 (diff) | |
| download | linux-stable-a1507d7f825dd45758f569c340a3b2fc7bfb5220.tar.gz linux-stable-a1507d7f825dd45758f569c340a3b2fc7bfb5220.tar.bz2 linux-stable-a1507d7f825dd45758f569c340a3b2fc7bfb5220.zip | |
sunrpc: fix refcount leak for rpc auth modules
commit f1442d6349a2e7bb7a6134791bdc26cb776c79af upstream.
If an auth module's accept op returns SVC_CLOSE, svc_process_common()
enters a call path that does not call svc_authorise() before leaving the
function, and thus leaks a reference on the auth module's refcount. Hence,
make sure calls to svc_authenticate() and svc_authorise() are paired for
all call paths, to make sure rpc auth modules can be unloaded.
Signed-off-by: Daniel Kobras <kobras@puzzle-itc.de>
Fixes: 4d712ef1db05 ("svcauth_gss: Close connection when dropping an incoming message")
Link: https://lore.kernel.org/linux-nfs/3F1B347F-B809-478F-A1E9-0BE98E22B0F0@oracle.com/T/#t
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/sunrpc/svc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c index 3a9a03717212..582b85182933 100644 --- a/net/sunrpc/svc.c +++ b/net/sunrpc/svc.c @@ -1329,7 +1329,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) sendit: if (svc_authorise(rqstp)) - goto close; + goto close_xprt; return 1; /* Caller can now send it */ dropit: @@ -1338,6 +1338,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) return 0; close: + svc_authorise(rqstp); +close_xprt: if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) svc_close_xprt(rqstp->rq_xprt); dprintk("svc: svc_process close\n"); @@ -1346,7 +1348,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) err_short_len: svc_printk(rqstp, "short len %zd, dropping request\n", argv->iov_len); - goto close; + goto close_xprt; err_bad_rpc: serv->sv_stats->rpcbadfmt++; |