From: Steve Dickson <SteveD@redhat.com> Subject: Re: [RHEL5.1][PATCH] RPC/krb5 memory leak Date: Tue, 29 May 2007 16:35:48 -0400 Bugzilla: 223248 Message-Id: <465C8EA4.7070108@RedHat.com> Changelog: [net] RPC/krb5 memory leak commit b797b5beac966df5c5d96c0d39fe366f57135343 Author: J.Bruce Fields <bfields@fieldses.org> [PATCH] knfsd: svcrpc: fix gss krb5i memory leak The memory leak here is embarassingly obvious. This fixes a problem that causes the kernel to leak a small amount of memory every time it receives a integrity-protected request. Thanks to Aim Le Rouzic for the bug report. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> --- linux-2.6.18.i686/net/sunrpc/auth_gss/svcauth_gss.c.orig 2006-09-19 23:42:06.000000000 -0400 +++ linux-2.6.18.i686/net/sunrpc/auth_gss/svcauth_gss.c 2007-05-25 08:19:47.000000000 -0400 @@ -807,19 +807,19 @@ unwrap_integ_data(struct xdr_buf *buf, u integ_len = ntohl(svc_getu32(&buf->head[0])); if (integ_len & 3) - goto out; + return stat; if (integ_len > buf->len) - goto out; + return stat; if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) BUG(); /* copy out mic... */ if (read_u32_from_xdr_buf(buf, integ_len, &mic.len)) BUG(); if (mic.len > RPC_MAX_AUTH_SIZE) - goto out; + return stat; mic.data = kmalloc(mic.len, GFP_KERNEL); if (!mic.data) - goto out; + return stat; if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len)) goto out; maj_stat = gss_verify_mic(ctx, &integ_buf, &mic); @@ -829,6 +829,7 @@ unwrap_integ_data(struct xdr_buf *buf, u goto out; stat = 0; out: + kfree(mic.data); return stat; }