mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-18 00:24:39 +00:00
NFS: fix an incorrect limit in filelayout_decode_layout()
commit769b01ea68
upstream. The "sizeof(struct nfs_fh)" is two bytes too large and could lead to memory corruption. It should be NFS_MAXFHSIZE because that's the size of the ->data[] buffer. I reversed the size of the arguments to put the variable on the left. Fixes:16b374ca43
("NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
1fbbcd1752
commit
9b367fe770
1 changed files with 1 additions and 1 deletions
|
@ -718,7 +718,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
|
|||
if (unlikely(!p))
|
||||
goto out_err;
|
||||
fl->fh_array[i]->size = be32_to_cpup(p++);
|
||||
if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) {
|
||||
if (fl->fh_array[i]->size > NFS_MAXFHSIZE) {
|
||||
printk(KERN_ERR "NFS: Too big fh %d received %d\n",
|
||||
i, fl->fh_array[i]->size);
|
||||
goto out_err;
|
||||
|
|
Loading…
Reference in a new issue