nfsd: Fix a memory leak in an error handling path

[ Upstream commit a396e5f29441061c7ba143b75f0b4022d173ab6a ]

If this memdup_user() call fails, the memory allocated in a previous call
a few lines above should be freed. Otherwise it leaks.

Fixes: 3bf84b31af3b ("nfsd: add support for upcall version 2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 7d408957ed6237cf3abf42c34bf2df6d6e5fca30..14463e107918f01e7923d7de90a348cf4e536884 100644 (file)
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -825,8 +825,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
                                princhash.data = memdup_user(
                                                &ci->cc_princhash.cp_data,
                                                princhashlen);
-                               if (IS_ERR_OR_NULL(princhash.data))
+                               if (IS_ERR_OR_NULL(princhash.data)) {
+                                       kfree(name.data);
                                        return -EFAULT;
+                               }
                                princhash.len = princhashlen;
                        } else
                                princhash.len = 0;