NFSv4.1/pnfs: Add sanity check for the layout range returned by the server (540d9864) · Commits · e / devices / android_kernel_fairphone_FP4

fs/nfs/pnfs.c

+24 −1

Original line number	Diff line number	Diff line
		@@ -1561,6 +1561,26 @@ pnfs_update_layout(struct inode *ino,
		}
		EXPORT_SYMBOL_GPL(pnfs_update_layout);

		static bool
		pnfs_sanity_check_layout_range(struct pnfs_layout_range *range)
		{
		switch (range->iomode) {
		case IOMODE_READ:
		case IOMODE_RW:
		break;
		default:
		return false;
		}
		if (range->offset == NFS4_MAX_UINT64)
		return false;
		if (range->length == 0)
		return false;
		if (range->length != NFS4_MAX_UINT64 &&
		range->length > NFS4_MAX_UINT64 - range->offset)
		return false;
		return true;
		}

		struct pnfs_layout_segment *
		pnfs_layout_process(struct nfs4_layoutget *lgp)
		{
		@@ -1569,7 +1589,10 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
		struct pnfs_layout_segment *lseg;
		struct inode *ino = lo->plh_inode;
		LIST_HEAD(free_me);
		int status = 0;
		int status = -EINVAL;

		if (!pnfs_sanity_check_layout_range(&res->range))
		goto out;

		/* Inject layout blob into I/O device driver */
		lseg = NFS_SERVER(ino)->pnfs_curr_ld->alloc_lseg(lo, res, lgp->gfp_flags);