mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-29 22:02:02 +00:00
Code Issues Releases Wiki Activity

NFSv4: Fix potential Oops in decode_op_map()

Browse source 
The return value of xdr_inline_decode() is not being checked, leading to
a potential Oops. Just replace the open coded array decode with the
generic XDR version.

Reported-by: <rtm@csail.mit.edu>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
This commit is contained in:
Trond Myklebust 2021-11-04 17:33:36 -04:00
parent 6659db4c59
commit f114759c32
1 changed files with 2 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
fs/nfs/nfs4xdr.c
View file

@ -5575,20 +5575,9 @@ static int decode_secinfo_no_name(struct xdr_stream *xdr, struct nfs4_secinfo_re
static int decode_op_map(struct xdr_stream *xdr, struct nfs4_op_map *op_map)
{
__be32 *p;
uint32_t bitmap_words;
unsigned int i;
p = xdr_inline_decode(xdr, 4);
if (!p)
if (xdr_stream_decode_uint32_array(xdr, op_map->u.words,
ARRAY_SIZE(op_map->u.words)) < 0)
return -EIO;
bitmap_words = be32_to_cpup(p++);
if (bitmap_words > NFS4_OP_MAP_NUM_WORDS)
return -EIO;
p = xdr_inline_decode(xdr, 4 * bitmap_words);
for (i = 0; i < bitmap_words; i++)
op_map->u.words[i] = be32_to_cpup(p++);
return 0;
}