Commit eecba7c0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfsd-6.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux 

Pull nfsd fix from Chuck Lever:

 - Fix an occasional memory overwrite caused by a fix added in 6.10

* tag 'nfsd-6.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
parents 0a02756d 4a77c3de

net/sunrpc/auth_gss/svcauth_gss.c

+1 −1
Original line number Diff line number Diff line
@@ -1069,7 +1069,7 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp, 
		goto out_denied_free;



	pages = DIV_ROUND_UP(inlen, PAGE_SIZE);

	in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);

	in_token->pages = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);

	if (!in_token->pages)

		goto out_denied_free;

	in_token->page_base = 0;