Unverified Commit 9a995c05 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14405 NFSD: Prevent a potential integer overflow 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FHLYTZJ6FB5BD4WTSWJHE3XI7XOTPUQ4/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBDHG9 
 
Link:https://gitee.com/openeuler/kernel/pulls/14405

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents b03a0aaa 96ee5656

fs/nfsd/nfs4callback.c

+7 −7
Original line number Diff line number Diff line
@@ -297,17 +297,17 @@ static int decode_cb_compound4res(struct xdr_stream *xdr, 
	u32 length;

	__be32 *p;



	p = xdr_inline_decode(xdr, 4 + 4);

	p = xdr_inline_decode(xdr, XDR_UNIT);

	if (unlikely(p == NULL))

		goto out_overflow;

	hdr->status = be32_to_cpup(p++);

	hdr->status = be32_to_cpup(p);

	/* Ignore the tag */

	length = be32_to_cpup(p++);

	p = xdr_inline_decode(xdr, length + 4);

	if (unlikely(p == NULL))

	if (xdr_stream_decode_u32(xdr, &length) < 0)

		goto out_overflow;

	if (xdr_inline_decode(xdr, length) == NULL)

		goto out_overflow;

	if (xdr_stream_decode_u32(xdr, &hdr->nops) < 0)

		goto out_overflow;

	p += XDR_QUADLEN(length);

	hdr->nops = be32_to_cpup(p);

	return 0;

out_overflow:

	return -EIO;