Commit 3a4236c3 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jakub Kicinski
Browse files

rxrpc: rxgk: Fix some reference count leaks 



These paths should call rxgk_put(gk) but they don't.  In the
rxgk_construct_response() function the "goto error;" will free the
"response" skb as well calling rxgk_put() so that's a bonus.

Fixes: 9d1d2b59 ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/aAikCbsnnzYtVmIA@stanley.mountain


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent ffb0c5c4

net/rxrpc/rxgk.c

+7 −3
Original line number Diff line number Diff line
@@ -440,8 +440,10 @@ static int rxgk_secure_packet(struct rxrpc_call *call, struct rxrpc_txbuf *txb) 
		return PTR_ERR(gk) == -ESTALE ? -EKEYREJECTED : PTR_ERR(gk);



	ret = key_validate(call->conn->key);

	if (ret < 0)

	if (ret < 0) {

		rxgk_put(gk);

		return ret;

	}



	call->security_enctype = gk->krb5->etype;

	txb->cksum = htons(gk->key_number);
@@ -483,7 +485,7 @@ static int rxgk_verify_packet_integrity(struct rxrpc_call *call, 


	hdr = kzalloc(sizeof(*hdr), GFP_NOFS);

	if (!hdr)

		return -ENOMEM;

		goto put_gk;



	hdr->epoch	= htonl(call->conn->proto.epoch);

	hdr->cid	= htonl(call->cid);
@@ -505,6 +507,7 @@ static int rxgk_verify_packet_integrity(struct rxrpc_call *call, 
		sp->len = len;

	}



put_gk:

	rxgk_put(gk);

	_leave(" = %d", ret);

	return ret;
@@ -594,6 +597,7 @@ static int rxgk_verify_packet(struct rxrpc_call *call, struct sk_buff *skb) 
	call->security_enctype = gk->krb5->etype;

	switch (call->conn->security_level) {

	case RXRPC_SECURITY_PLAIN:

		rxgk_put(gk);

		return 0;

	case RXRPC_SECURITY_AUTH:

		return rxgk_verify_packet_integrity(call, gk, skb);
@@ -969,7 +973,7 @@ static int rxgk_construct_response(struct rxrpc_connection *conn, 


	ret = rxgk_pad_out(response, authx_len, authx_offset + authx_len);

	if (ret < 0)

		return ret;

		goto error;

	len = authx_offset + authx_len + ret;



	if (len != response->len) {