diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index f5111d62972d3d17f74022812ad8c0ed8aba6802..24a7f69e07563333274f5fa0278a2487c67b6645 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1160,7 +1160,7 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
 		return SVC_DENIED;
 
 	pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
-	in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
+	in_token->pages = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);
 	if (!in_token->pages)
 		return SVC_DENIED;
 	in_token->page_base = 0;