nfsd: fix possible oops on re-insertion of rpcsec_gss modules

The handling of the re-registration case is wrong here; the "test" that was
returned from auth_domain_lookup will not be used again, so that reference
should be put.  And auth_domain_lookup never did anything with "new" in
this case, so we should just clean it up ourself.

Thanks to Akinobu Mita for bug report, analysis, and testing.

Cc: Akinobu Mita <[email protected]>
Signed-off-by: "J. Bruce Fields" <[email protected]>
Cc: Neil Brown <[email protected]>
Cc: Trond Myklebust <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 490697542fc27d7f08dba7277c88ae46e71c57f0..dc2f41e9f577dbb657bc9a6fbd8277a8e352f029 100644 (file)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -769,11 +769,12 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
        new->h.flavour = &svcauthops_gss;
        new->pseudoflavor = pseudoflavor;
 
+       stat = 0;
        test = auth_domain_lookup(name, &new->h);
-       if (test != &new->h) { /* XXX Duplicate registration? */
-               auth_domain_put(&new->h);
-               /* dangling ref-count... */
-               goto out;
+       if (test != &new->h) { /* Duplicate registration */
+               auth_domain_put(test);
+               kfree(new->h.name);
+               goto out_free_dom;
        }
        return 0;