diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2017-05-05 22:17:57 +0200 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2017-05-10 20:25:19 +0200 |
| commit | f961e3f2acae94b727380c0b74e2d3954d0edf79 (patch) | |
| tree | de0fd2594a2efeaa34bdefff2880ef9824975cf3 /fs/9p | |
| parent | nfsd: fix undefined behavior in nfsd4_layout_verify (diff) | |
| download | linux-f961e3f2acae94b727380c0b74e2d3954d0edf79.tar.xz linux-f961e3f2acae94b727380c0b74e2d3954d0edf79.zip | |
nfsd: encoders mustn't use unitialized values in error cases
In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.
This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.
GETDEVICEINFO has the same problem.
Reported-by: Ari Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions