Commit 9a472362 authored by J. Bruce Fields's avatar J. Bruce Fields Committed by Greg Kroah-Hartman

nfsd: encoders mustn't use unitialized values in error cases

commit f961e3f2 upstream.

In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.

This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.

GETDEVICEINFO has the same problem.
Reported-by: default avatarAri Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 06cc61e8
...@@ -4119,8 +4119,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, ...@@ -4119,8 +4119,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
struct nfsd4_getdeviceinfo *gdev) struct nfsd4_getdeviceinfo *gdev)
{ {
struct xdr_stream *xdr = &resp->xdr; struct xdr_stream *xdr = &resp->xdr;
const struct nfsd4_layout_ops *ops = const struct nfsd4_layout_ops *ops;
nfsd4_layout_ops[gdev->gd_layout_type];
u32 starting_len = xdr->buf->len, needed_len; u32 starting_len = xdr->buf->len, needed_len;
__be32 *p; __be32 *p;
...@@ -4137,6 +4136,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, ...@@ -4137,6 +4136,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
/* If maxcount is 0 then just update notifications */ /* If maxcount is 0 then just update notifications */
if (gdev->gd_maxcount != 0) { if (gdev->gd_maxcount != 0) {
ops = nfsd4_layout_ops[gdev->gd_layout_type];
nfserr = ops->encode_getdeviceinfo(xdr, gdev); nfserr = ops->encode_getdeviceinfo(xdr, gdev);
if (nfserr) { if (nfserr) {
/* /*
...@@ -4189,8 +4189,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr, ...@@ -4189,8 +4189,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
struct nfsd4_layoutget *lgp) struct nfsd4_layoutget *lgp)
{ {
struct xdr_stream *xdr = &resp->xdr; struct xdr_stream *xdr = &resp->xdr;
const struct nfsd4_layout_ops *ops = const struct nfsd4_layout_ops *ops;
nfsd4_layout_ops[lgp->lg_layout_type];
__be32 *p; __be32 *p;
dprintk("%s: err %d\n", __func__, nfserr); dprintk("%s: err %d\n", __func__, nfserr);
...@@ -4213,6 +4212,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr, ...@@ -4213,6 +4212,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
*p++ = cpu_to_be32(lgp->lg_seg.iomode); *p++ = cpu_to_be32(lgp->lg_seg.iomode);
*p++ = cpu_to_be32(lgp->lg_layout_type); *p++ = cpu_to_be32(lgp->lg_layout_type);
ops = nfsd4_layout_ops[lgp->lg_layout_type];
nfserr = ops->encode_layoutget(xdr, lgp); nfserr = ops->encode_layoutget(xdr, lgp);
out: out:
kfree(lgp->lg_content); kfree(lgp->lg_content);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment