Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51d9c515 authored by J. Bruce Fields's avatar J. Bruce Fields Committed by Greg Kroah-Hartman
Browse files

nfsd: encoders mustn't use unitialized values in error cases 



commit f961e3f2acae94b727380c0b74e2d3954d0edf79 upstream.

In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.

This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.

GETDEVICEINFO has the same problem.

Reported-by: default avatarAri Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ea465551

fs/nfsd/nfs4xdr.c

+4 −4
Original line number Diff line number Diff line
@@ -4081,8 +4081,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, 
		struct nfsd4_getdeviceinfo *gdev)

{

	struct xdr_stream *xdr = &resp->xdr;

	const struct nfsd4_layout_ops *ops =

		nfsd4_layout_ops[gdev->gd_layout_type];

	const struct nfsd4_layout_ops *ops;

	u32 starting_len = xdr->buf->len, needed_len;

	__be32 *p;
@@ -4099,6 +4098,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, 


	/* If maxcount is 0 then just update notifications */

	if (gdev->gd_maxcount != 0) {

		ops = nfsd4_layout_ops[gdev->gd_layout_type];

		nfserr = ops->encode_getdeviceinfo(xdr, gdev);

		if (nfserr) {

			/*
@@ -4151,8 +4151,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr, 
		struct nfsd4_layoutget *lgp)

{

	struct xdr_stream *xdr = &resp->xdr;

	const struct nfsd4_layout_ops *ops =

		nfsd4_layout_ops[lgp->lg_layout_type];

	const struct nfsd4_layout_ops *ops;

	__be32 *p;



	dprintk("%s: err %d\n", __func__, nfserr);
@@ -4175,6 +4174,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr, 
	*p++ = cpu_to_be32(lgp->lg_seg.iomode);

	*p++ = cpu_to_be32(lgp->lg_layout_type);



	ops = nfsd4_layout_ops[lgp->lg_layout_type];

	nfserr = ops->encode_layoutget(xdr, lgp);

out:

	kfree(lgp->lg_content);