mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 15:18:19 +00:00
SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
commit4a77c3dead
upstream. The in_token->pages[] array is not NULL terminated. This results in the following KASAN splat: KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f] Fixes:bafa6b4d95
("SUNRPC: Fix gss_free_in_token_pages()") Reviewed-by: Benjamin Coddington <bcodding@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
f5f4675960
commit
6ed45d20d3
1 changed files with 1 additions and 1 deletions
|
@ -1104,7 +1104,7 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
|
|||
}
|
||||
|
||||
pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
|
||||
in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
|
||||
in_token->pages = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);
|
||||
if (!in_token->pages) {
|
||||
kfree(in_handle->data);
|
||||
return SVC_DENIED;
|
||||
|
|
Loading…
Reference in a new issue