Skip to content

Commit f114759

Browse files
author
Trond Myklebust
committed
NFSv4: Fix potential Oops in decode_op_map()
The return value of xdr_inline_decode() is not being checked, leading to a potential Oops. Just replace the open coded array decode with the generic XDR version. Reported-by: <[email protected]> Signed-off-by: Trond Myklebust <[email protected]>
1 parent 6659db4 commit f114759

File tree

1 file changed

+2
-13
lines changed

1 file changed

+2
-13
lines changed

fs/nfs/nfs4xdr.c

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5575,20 +5575,9 @@ static int decode_secinfo_no_name(struct xdr_stream *xdr, struct nfs4_secinfo_re
55755575

55765576
static int decode_op_map(struct xdr_stream *xdr, struct nfs4_op_map *op_map)
55775577
{
5578-
__be32 *p;
5579-
uint32_t bitmap_words;
5580-
unsigned int i;
5581-
5582-
p = xdr_inline_decode(xdr, 4);
5583-
if (!p)
5584-
return -EIO;
5585-
bitmap_words = be32_to_cpup(p++);
5586-
if (bitmap_words > NFS4_OP_MAP_NUM_WORDS)
5578+
if (xdr_stream_decode_uint32_array(xdr, op_map->u.words,
5579+
ARRAY_SIZE(op_map->u.words)) < 0)
55875580
return -EIO;
5588-
p = xdr_inline_decode(xdr, 4 * bitmap_words);
5589-
for (i = 0; i < bitmap_words; i++)
5590-
op_map->u.words[i] = be32_to_cpup(p++);
5591-
55925581
return 0;
55935582
}
55945583

0 commit comments

Comments
 (0)