sunrpc: handle ENOMEM in rpcb_getport_async

BugLink: https://bugs.launchpad.net/bugs/1837477
commit 81c88b18de1f11f70c97f28ced8d642c00bb3955 upstream.

If we ignore the error we'll hit a null dereference a little later.

Reported-by: syzbot+4b98281f2401ab849f4b@syzkaller.appspotmail.com
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index c526f8fb37c924a36712dd04385d1e0d4b0116e8..82c120e51d64cf7314f8e306123f27ec7bc9b821 100644 (file)
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -771,6 +771,12 @@ void rpcb_getport_async(struct rpc_task *task)
        case RPCBVERS_3:
                map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID];
                map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC);
+               if (!map->r_addr) {
+                       status = -ENOMEM;
+                       dprintk("RPC: %5u %s: no memory available\n",
+                               task->tk_pid, __func__);
+                       goto bailout_free_args;
+               }
                map->r_owner = "";
                break;
        case RPCBVERS_2:
@@ -793,6 +799,8 @@ void rpcb_getport_async(struct rpc_task *task)
        rpc_put_task(child);
        return;
 
+bailout_free_args:
+       kfree(map);
 bailout_release_client:
        rpc_release_client(rpcb_clnt);
 bailout_nofree: