Skip to content

Commit f961e3f

Browse files
author
J. Bruce Fields
committed
nfsd: encoders mustn't use unitialized values in error cases
In error cases, lgp->lg_layout_type may be out of bounds; so we shouldn't be using it until after the check of nfserr. This was seen to crash nfsd threads when the server receives a LAYOUTGET request with a large layout type. GETDEVICEINFO has the same problem. Reported-by: Ari Kauppi <Ari.Kauppi@synopsys.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com>
1 parent b550a32 commit f961e3f

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

Diff for: fs/nfsd/nfs4xdr.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -4119,8 +4119,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
41194119
struct nfsd4_getdeviceinfo *gdev)
41204120
{
41214121
struct xdr_stream *xdr = &resp->xdr;
4122-
const struct nfsd4_layout_ops *ops =
4123-
nfsd4_layout_ops[gdev->gd_layout_type];
4122+
const struct nfsd4_layout_ops *ops;
41244123
u32 starting_len = xdr->buf->len, needed_len;
41254124
__be32 *p;
41264125

@@ -4137,6 +4136,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
41374136

41384137
/* If maxcount is 0 then just update notifications */
41394138
if (gdev->gd_maxcount != 0) {
4139+
ops = nfsd4_layout_ops[gdev->gd_layout_type];
41404140
nfserr = ops->encode_getdeviceinfo(xdr, gdev);
41414141
if (nfserr) {
41424142
/*
@@ -4189,8 +4189,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
41894189
struct nfsd4_layoutget *lgp)
41904190
{
41914191
struct xdr_stream *xdr = &resp->xdr;
4192-
const struct nfsd4_layout_ops *ops =
4193-
nfsd4_layout_ops[lgp->lg_layout_type];
4192+
const struct nfsd4_layout_ops *ops;
41944193
__be32 *p;
41954194

41964195
dprintk("%s: err %d\n", __func__, nfserr);
@@ -4213,6 +4212,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
42134212
*p++ = cpu_to_be32(lgp->lg_seg.iomode);
42144213
*p++ = cpu_to_be32(lgp->lg_layout_type);
42154214

4215+
ops = nfsd4_layout_ops[lgp->lg_layout_type];
42164216
nfserr = ops->encode_layoutget(xdr, lgp);
42174217
out:
42184218
kfree(lgp->lg_content);

0 commit comments

Comments
 (0)