Unverified Commit d4529c0b authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14404 NFSD: Prevent a potential integer overflow 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ESMWBE7H7ICBXMOZNVA3H3KO6WH4IQ7U/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBDHG9 
 
Link:https://gitee.com/openeuler/kernel/pulls/14404

 

Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 4dc4cec0 78271d69

fs/nfsd/nfs4callback.c

+7 −7
Original line number Diff line number Diff line
@@ -294,17 +294,17 @@ static int decode_cb_compound4res(struct xdr_stream *xdr, 
	u32 length;

	__be32 *p;



	p = xdr_inline_decode(xdr, 4 + 4);

	p = xdr_inline_decode(xdr, XDR_UNIT);

	if (unlikely(p == NULL))

		goto out_overflow;

	hdr->status = be32_to_cpup(p++);

	hdr->status = be32_to_cpup(p);

	/* Ignore the tag */

	length = be32_to_cpup(p++);

	p = xdr_inline_decode(xdr, length + 4);

	if (unlikely(p == NULL))

	if (xdr_stream_decode_u32(xdr, &length) < 0)

		goto out_overflow;

	if (xdr_inline_decode(xdr, length) == NULL)

		goto out_overflow;

	if (xdr_stream_decode_u32(xdr, &hdr->nops) < 0)

		goto out_overflow;

	p += XDR_QUADLEN(length);

	hdr->nops = be32_to_cpup(p);

	return 0;

out_overflow:

	print_overflow_msg(__func__, xdr);