Commit 8c7424cff6 "nfsd4: don't try to encode conflicting owner if low on space" forgot to free conf->data in nfsd4_encode_lockt and before sign conf->data to NULL in nfsd4_encode_lock_denied, causing a leak. Worse, kfree() can be called on an uninitialized pointer in the case of a succesful lock (or one that fails for a reason other than a conflict). (Note that lock->lk_denied.ld_owner.data appears it should be zero here, until you notice that it's one arm of a union the other arm of which is written to in the succesful case by the memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid, sizeof(stateid_t)); in nfsd4_lock(). In the 32-bit case this overwrites ld_owner.data.)
Unified · Split
| @@ -2879,6 +2879,7 @@ again: · 2878 unmodified lines | ||
| 2879 | 2879 | * return the conflicting open: |
| 2880 | 2880 | */ |
| 2881 | 2881 | if (conf->len) { |
| 2882 | + kfree(conf->data); | |
| 2882 | 2883 | conf->len = 0; |
| 2883 | 2884 | conf->data = NULL; |
| 2884 | 2885 | goto again; |
| @@ -2891,6 +2892,7 @@ again: · 6 unmodified lines | ||
| 2891 | 2892 | if (conf->len) { |
| 2892 | 2893 | p = xdr_encode_opaque_fixed(p, &ld->ld_clientid, 8); |
| 2893 | 2894 | p = xdr_encode_opaque(p, conf->data, conf->len); |
| 2895 | + kfree(conf->data); | |
| 2894 | 2896 | } else { /* non - nfsv4 lock in conflict, no clientid nor owner */ |
| 2895 | 2897 | p = xdr_encode_hyper(p, (u64)0); /* clientid */ |
| 2896 | 2898 | *p++ = cpu_to_be32(0); /* length of owner name */ |
| @@ -2907,7 +2909,7 @@ nfsd4_encode_lock(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_lo · 10 unmodified lines | ||
| 2907 | 2909 | nfserr = nfsd4_encode_stateid(xdr, &lock->lk_resp_stateid); |
| 2908 | 2910 | else if (nfserr == nfserr_denied) |
| 2909 | 2911 | nfserr = nfsd4_encode_lock_denied(xdr, &lock->lk_denied); |
| 2910 | − kfree(lock->lk_denied.ld_owner.data); | |
| 2912 | + | |
| 2911 | 2913 | return nfserr; |
| 2912 | 2914 | } |
| 2913 | 2915 | |