diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-05-11 11:49:42 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-06-03 09:00:35 +0200 |
| commit | 9b367fe770b1b80d7bf64ed0d177544a44405f6e (patch) | |
| tree | 21eab6b809378bd994c10a77ecb75806727859eb | |
| parent | 1fbbcd1752ff4fbfed3752a5d52e518625e660d7 (diff) | |
| download | linux-stable-9b367fe770b1b80d7bf64ed0d177544a44405f6e.tar.gz linux-stable-9b367fe770b1b80d7bf64ed0d177544a44405f6e.tar.bz2 linux-stable-9b367fe770b1b80d7bf64ed0d177544a44405f6e.zip | |
NFS: fix an incorrect limit in filelayout_decode_layout()
commit 769b01ea68b6c49dc3cde6adf7e53927dacbd3a8 upstream.
The "sizeof(struct nfs_fh)" is two bytes too large and could lead to
memory corruption. It should be NFS_MAXFHSIZE because that's the size
of the ->data[] buffer.
I reversed the size of the arguments to put the variable on the left.
Fixes: 16b374ca439f ("NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/nfs/filelayout/filelayout.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c index 7f5aa0403e16..ae5ed3a07494 100644 --- a/fs/nfs/filelayout/filelayout.c +++ b/fs/nfs/filelayout/filelayout.c @@ -718,7 +718,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo, if (unlikely(!p)) goto out_err; fl->fh_array[i]->size = be32_to_cpup(p++); - if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) { + if (fl->fh_array[i]->size > NFS_MAXFHSIZE) { printk(KERN_ERR "NFS: Too big fh %d received %d\n", i, fl->fh_array[i]->size); goto out_err; |