rpcb_register_inet4() and rpcb_register_inet6() store the universal
address unchecked. rpc_sockaddr2uaddr() returns NULL when its GFP_KERNEL
kstrdup() fails, and encode_rpcb_string() then calls strlen() on it.

Return -ENOMEM instead.

Fixes: ba809130bc26 ("SUNRPC: Remove duplicate universal address generation")
Assisted-by: LLM
Signed-off-by: Jeff Layton <[email protected]>
---
 net/sunrpc/rpcb_clnt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 7255c1e07eec..397919f2a38b 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -518,6 +518,8 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
        int result;
 
        map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
+       if (!map->r_addr)
+               return -ENOMEM;
 
        msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
        if (port != 0) {
@@ -544,6 +546,8 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
        int result;
 
        map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
+       if (!map->r_addr)
+               return -ENOMEM;
 
        msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
        if (port != 0) {

-- 
2.55.0


Reply via email to