Skip to content

Commit

Permalink
sunrpc: fix refcount leak for rpc auth modules
Browse files Browse the repository at this point in the history
commit f1442d6 upstream.

If an auth module's accept op returns SVC_CLOSE, svc_process_common()
enters a call path that does not call svc_authorise() before leaving the
function, and thus leaks a reference on the auth module's refcount. Hence,
make sure calls to svc_authenticate() and svc_authorise() are paired for
all call paths, to make sure rpc auth modules can be unloaded.

Signed-off-by: Daniel Kobras <kobras@puzzle-itc.de>
Fixes: 4d712ef ("svcauth_gss: Close connection when dropping an incoming message")
Link: https://lore.kernel.org/linux-nfs/3F1B347F-B809-478F-A1E9-0BE98E22B0F0@oracle.com/T/#t
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
dkobras authored and gregkh committed Mar 24, 2021
1 parent 3c57ea0 commit f0b09d5
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions net/sunrpc/svc.c
Expand Up @@ -1417,7 +1417,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)

sendit:
if (svc_authorise(rqstp))
goto close;
goto close_xprt;
return 1; /* Caller can now send it */

release_dropit:
Expand All @@ -1429,6 +1429,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
return 0;

close:
svc_authorise(rqstp);
close_xprt:
if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
svc_close_xprt(rqstp->rq_xprt);
dprintk("svc: svc_process close\n");
Expand All @@ -1437,7 +1439,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
err_short_len:
svc_printk(rqstp, "short len %zd, dropping request\n",
argv->iov_len);
goto close;
goto close_xprt;

err_bad_rpc:
serv->sv_stats->rpcbadfmt++;
Expand Down

0 comments on commit f0b09d5

Please sign in to comment.