From: Steve Dickson <SteveD@redhat.com>
Subject: Re: [RHEL5.1][PATCH] RPC/krb5 memory leak
Date: Tue, 29 May 2007 16:35:48 -0400
Bugzilla: 223248
Message-Id: <465C8EA4.7070108@RedHat.com>
Changelog: [net] RPC/krb5 memory leak

commit b797b5beac966df5c5d96c0d39fe366f57135343
Author: J.Bruce Fields <bfields@fieldses.org>

    [PATCH] knfsd: svcrpc: fix gss krb5i memory leak
    
    The memory leak here is embarassingly obvious.
    
    This fixes a problem that causes the kernel to leak a small amount of memory
    every time it receives a integrity-protected request.
    
    Thanks to Aim Le Rouzic for the bug report.
    
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
    Signed-off-by: Neil Brown <neilb@suse.de>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Linus Torvalds <torvalds@osdl.org>

--- linux-2.6.18.i686/net/sunrpc/auth_gss/svcauth_gss.c.orig	2006-09-19 23:42:06.000000000 -0400
+++ linux-2.6.18.i686/net/sunrpc/auth_gss/svcauth_gss.c	2007-05-25 08:19:47.000000000 -0400
@@ -807,19 +807,19 @@ unwrap_integ_data(struct xdr_buf *buf, u
 
 	integ_len = ntohl(svc_getu32(&buf->head[0]));
 	if (integ_len & 3)
-		goto out;
+		return stat;
 	if (integ_len > buf->len)
-		goto out;
+		return stat;
 	if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))
 		BUG();
 	/* copy out mic... */
 	if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
 		BUG();
 	if (mic.len > RPC_MAX_AUTH_SIZE)
-		goto out;
+		return stat;
 	mic.data = kmalloc(mic.len, GFP_KERNEL);
 	if (!mic.data)
-		goto out;
+		return stat;
 	if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
 		goto out;
 	maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
@@ -829,6 +829,7 @@ unwrap_integ_data(struct xdr_buf *buf, u
 		goto out;
 	stat = 0;
 out:
+	kfree(mic.data);
 	return stat;
 }