releases/2.6.22.2/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch

From stable-bounces@linux.kernel.org Mon Jul 23 18:44:35 2007
From: J. Bruce Fields <bfields@citi.umich.edu>
Date: Mon, 23 Jul 2007 18:43:52 -0700
Subject: nfsd: fix possible oops on re-insertion of rpcsec_gss modules
To: torvalds@linux-foundation.org
Cc: neilb@suse.de, bfields@citi.umich.edu, akinobu.mita@gmail.com, trond.myklebust@fys.uio.no, akpm@linux-foundation.org, stable@kernel.org
Message-ID: <200707240143.l6O1hqkS022398@imap1.linux-foundation.org>


From: J. Bruce Fields <bfields@citi.umich.edu>

The handling of the re-registration case is wrong here; the "test" that was
returned from auth_domain_lookup will not be used again, so that reference
should be put.  And auth_domain_lookup never did anything with "new" in
this case, so we should just clean it up ourself.

Thanks to Akinobu Mita for bug report, analysis, and testing.

Cc: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu>
Cc: Neil Brown <neilb@suse.de>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/sunrpc/auth_gss/svcauth_gss.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -760,11 +760,12 @@ svcauth_gss_register_pseudoflavor(u32 ps
 	new->h.flavour = &svcauthops_gss;
 	new->pseudoflavor = pseudoflavor;
 
+	stat = 0;
 	test = auth_domain_lookup(name, &new->h);
-	if (test != &new->h) { /* XXX Duplicate registration? */
-		auth_domain_put(&new->h);
-		/* dangling ref-count... */
-		goto out;
+	if (test != &new->h) { /* Duplicate registration */
+		auth_domain_put(test);
+		kfree(new->h.name);
+		goto out_free_dom;
 	}
 	return 0;