Commit f114759c authored by Trond Myklebust's avatar Trond Myklebust
Browse files

NFSv4: Fix potential Oops in decode_op_map() 



The return value of xdr_inline_decode() is not being checked, leading to
a potential Oops. Just replace the open coded array decode with the
generic XDR version.

Reported-by: default avatar <rtm@csail.mit.edu>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent 6659db4c

fs/nfs/nfs4xdr.c

+2 −13
Original line number Diff line number Diff line
@@ -5575,20 +5575,9 @@ static int decode_secinfo_no_name(struct xdr_stream *xdr, struct nfs4_secinfo_re 


static int decode_op_map(struct xdr_stream *xdr, struct nfs4_op_map *op_map)

{

	__be32 *p;

	uint32_t bitmap_words;

	unsigned int i;



	p = xdr_inline_decode(xdr, 4);

	if (!p)

		return -EIO;

	bitmap_words = be32_to_cpup(p++);

	if (bitmap_words > NFS4_OP_MAP_NUM_WORDS)

	if (xdr_stream_decode_uint32_array(xdr, op_map->u.words,

					   ARRAY_SIZE(op_map->u.words)) < 0)

		return -EIO;

	p = xdr_inline_decode(xdr, 4 * bitmap_words);

	for (i = 0; i < bitmap_words; i++)

		op_map->u.words[i] = be32_to_cpup(p++);



	return 0;

}