iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sunrpc: handle ENOMEM in rpcb_getport_async

Browse Source 
If we ignore the error we'll hit a null dereference a little later.

Reported-by: syzbot+4b98281f2401ab849f4b@syzkaller.appspotmail.com
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
This commit is contained in:
J. Bruce Fields 2018-12-20 10:35:11 -05:00 committed by Anna Schumaker
parent c2c7d84fd1
commit 81c88b18de
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
net/sunrpc/rpcb_clnt.c
View File

@ -771,6 +771,12 @@ void rpcb_getport_async(struct rpc_task *task)
case RPCBVERS_3: case RPCBVERS_3:
map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID]; map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID];
map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC); map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC);
if (!map->r_addr) {
status = -ENOMEM;
dprintk("RPC: %5u %s: no memory available\n",
task->tk_pid, __func__);
goto bailout_free_args;
}
map->r_owner = ""; map->r_owner = "";
break; break;
case RPCBVERS_2: case RPCBVERS_2:
@ -793,6 +799,8 @@ void rpcb_getport_async(struct rpc_task *task)
rpc_put_task(child); rpc_put_task(child);
return; return;
bailout_free_args:
kfree(map);
bailout_release_client: bailout_release_client:
rpc_release_client(rpcb_clnt); rpc_release_client(rpcb_clnt);
bailout_nofree: bailout_nofree: