nfsd: Fix a memory leak in an error handling path

If this memdup_user() call fails, the memory allocated in a previous call
a few lines above should be freed. Otherwise it leaks.

Fixes: 6ee95d1c8991 ("nfsd: add support for upcall version 2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index c634483d85d2a312db0b69b61294d35bab845d9d..8f24485e0f04f379754ce4938ab6d3fab9e8b29e 100644 (file)
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -815,8 +815,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
                                princhash.data = memdup_user(
                                                &ci->cc_princhash.cp_data,
                                                princhashlen);
-                               if (IS_ERR_OR_NULL(princhash.data))
+                               if (IS_ERR_OR_NULL(princhash.data)) {
+                                       kfree(name.data);
                                        return -EFAULT;
+                               }
                                princhash.len = princhashlen;
                        } else
                                princhash.len = 0;