summaryrefslogtreecommitdiffstats
path: root/net/sunrpc
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2018-12-20 10:35:11 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-01-23 08:09:50 +0100
commitf85592f4c0cb6c6b99e6e4fcd1701fa19d79c587 (patch)
tree81751fba8729db1a446c0ec20fa97473efce737f /net/sunrpc
parenteb376a62ac5d0ad2d0b98e9ca6eeb71e2efa53ac (diff)
downloadlinux-stable-f85592f4c0cb6c6b99e6e4fcd1701fa19d79c587.tar.gz
linux-stable-f85592f4c0cb6c6b99e6e4fcd1701fa19d79c587.tar.bz2
linux-stable-f85592f4c0cb6c6b99e6e4fcd1701fa19d79c587.zip
sunrpc: handle ENOMEM in rpcb_getport_async
commit 81c88b18de1f11f70c97f28ced8d642c00bb3955 upstream. If we ignore the error we'll hit a null dereference a little later. Reported-by: syzbot+4b98281f2401ab849f4b@syzkaller.appspotmail.com Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/sunrpc')
-rw-r--r--net/sunrpc/rpcb_clnt.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index ea0676f199c8..da21efac80f4 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -771,6 +771,12 @@ void rpcb_getport_async(struct rpc_task *task)
case RPCBVERS_3:
map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID];
map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC);
+ if (!map->r_addr) {
+ status = -ENOMEM;
+ dprintk("RPC: %5u %s: no memory available\n",
+ task->tk_pid, __func__);
+ goto bailout_free_args;
+ }
map->r_owner = "";
break;
case RPCBVERS_2:
@@ -793,6 +799,8 @@ void rpcb_getport_async(struct rpc_task *task)
rpc_put_task(child);
return;
+bailout_free_args:
+ kfree(map);
bailout_release_client:
rpc_release_client(rpcb_clnt);
bailout_nofree: