From: Chuck Lever <chuck.lever@oracle.com>
Date: Sat, 8 Oct 2022 18:58:29 +0000 (-0400)
Subject: SUNRPC: Fix crasher in gss_unwrap_resp_integ()
X-Git-Tag: v6.6.17~6248^2~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=8a0fa3ff3b606b55c4edc71ad133e61529b64549;p=platform%2Fkernel%2Flinux-rpi.git

SUNRPC: Fix crasher in gss_unwrap_resp_integ()

If a zero length is passed to kmalloc() it returns 0x10, which is
not a valid address. gss_unwrap_resp_integ() subsequently crashes
when it attempts to dereference that pointer.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
---

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index a31a278..7bb247c 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1989,7 +1989,7 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
 		goto unwrap_failed;
 	mic.len = len;
 	mic.data = kmalloc(len, GFP_KERNEL);
-	if (!mic.data)
+	if (ZERO_OR_NULL_PTR(mic.data))
 		goto unwrap_failed;
 	if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
 		goto unwrap_failed;