Unverified Commit 308ccbdf authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14407 NFSD: Prevent a potential integer overflow 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LUGI45TIEOC5UFVK2RFVV4RWN4SMLVAQ/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBDHG9 
 
Link:https://gitee.com/openeuler/kernel/pulls/14407

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 2a9b96eb 7231e52f

fs/nfsd/nfs4callback.c

+7 −7
Original line number Diff line number Diff line
@@ -286,17 +286,17 @@ static int decode_cb_compound4res(struct xdr_stream *xdr, 
	u32 length;

	__be32 *p;



	p = xdr_inline_decode(xdr, 4 + 4);

	p = xdr_inline_decode(xdr, XDR_UNIT);

	if (unlikely(p == NULL))

		goto out_overflow;

	hdr->status = be32_to_cpup(p++);

	hdr->status = be32_to_cpup(p);

	/* Ignore the tag */

	length = be32_to_cpup(p++);

	p = xdr_inline_decode(xdr, length + 4);

	if (unlikely(p == NULL))

	if (xdr_stream_decode_u32(xdr, &length) < 0)

		goto out_overflow;

	if (xdr_inline_decode(xdr, length) == NULL)

		goto out_overflow;

	if (xdr_stream_decode_u32(xdr, &hdr->nops) < 0)

		goto out_overflow;

	p += XDR_QUADLEN(length);

	hdr->nops = be32_to_cpup(p);

	return 0;

out_overflow:

	return -EIO;