diff options
| author | Trond Myklebust <trond.myklebust@hammerspace.com> | 2021-11-07 15:15:44 +0100 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@hammerspace.com> | 2021-11-07 15:23:14 +0100 |
| commit | f96f8cc4a63dd645e07ea9712be4e0a76ea4ec1f (patch) | |
| tree | 85ebbff5baf8324fc653747813e5b5d4a9c12e51 /fs/nfs/nfs4session.c | |
| parent | NFS: Remove the nfs4_label argument from decode_getattr_*() functions (diff) | |
| download | linux-f96f8cc4a63dd645e07ea9712be4e0a76ea4ec1f.tar.xz linux-f96f8cc4a63dd645e07ea9712be4e0a76ea4ec1f.zip | |
NFSv4: Sanity check the parameters in nfs41_update_target_slotid()
Ensure that the values supplied by the server do not exceed the size of
the largest allowed slot table.
Reported-by: <rtm@csail.mit.edu>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Diffstat (limited to 'fs/nfs/nfs4session.c')
| -rw-r--r-- | fs/nfs/nfs4session.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c index 4145a0138907..5db460476bf2 100644 --- a/fs/nfs/nfs4session.c +++ b/fs/nfs/nfs4session.c @@ -511,12 +511,16 @@ void nfs41_update_target_slotid(struct nfs4_slot_table *tbl, struct nfs4_slot *slot, struct nfs4_sequence_res *res) { + u32 target_highest_slotid = min(res->sr_target_highest_slotid, + NFS4_MAX_SLOTID); + u32 highest_slotid = min(res->sr_highest_slotid, NFS4_MAX_SLOTID); + spin_lock(&tbl->slot_tbl_lock); - if (!nfs41_is_outlier_target_slotid(tbl, res->sr_target_highest_slotid)) - nfs41_set_target_slotid_locked(tbl, res->sr_target_highest_slotid); + if (!nfs41_is_outlier_target_slotid(tbl, target_highest_slotid)) + nfs41_set_target_slotid_locked(tbl, target_highest_slotid); if (tbl->generation == slot->generation) - nfs41_set_server_slotid_locked(tbl, res->sr_highest_slotid); - nfs41_set_max_slotid_locked(tbl, res->sr_target_highest_slotid); + nfs41_set_server_slotid_locked(tbl, highest_slotid); + nfs41_set_max_slotid_locked(tbl, target_highest_slotid); spin_unlock(&tbl->slot_tbl_lock); } |