~hc/RK356X_SDK_RELEASE.git

..	..	@@ -1156,18 +1156,23 @@
1156	1156	return res;
1157	1157
1158	1158	inlen = svc_getnl(argv);
1159		- if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
	1159	+ if (inlen > (argv->iov_len + rqstp->rq_arg.page_len)) {
	1160	+ kfree(in_handle->data);
1160	1161	return SVC_DENIED;
	1162	+ }
1161	1163
1162	1164	pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
1163	1165	in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
1164		- if (!in_token->pages)
	1166	+ if (!in_token->pages) {
	1167	+ kfree(in_handle->data);
1165	1168	return SVC_DENIED;
	1169	+ }
1166	1170	in_token->page_base = 0;
1167	1171	in_token->page_len = inlen;
1168	1172	for (i = 0; i < pages; i++) {
1169	1173	in_token->pages[i] = alloc_page(GFP_KERNEL);
1170	1174	if (!in_token->pages[i]) {
	1175	+ kfree(in_handle->data);
1171	1176	gss_free_in_token_pages(in_token);
1172	1177	return SVC_DENIED;
1173	1178	}