]> www.infradead.org Git - users/jedix/linux-maple.git/commit
nfsd: encoders mustn't use unitialized values in error cases
authorJ. Bruce Fields <bfields@redhat.com>
Fri, 5 May 2017 20:17:57 +0000 (16:17 -0400)
committerKirtikar Kashyap <kirtikar.kashyap@oracle.com>
Fri, 4 Aug 2017 19:54:50 +0000 (12:54 -0700)
commit360051db10d6eecdc79cbcc357933d2dfd3547a9
tree2284400b6b9abfb4b0000e34f4856ee9fb00251f
parenta7705157664b489cd280b5ab1c384ede66043ed1
nfsd: encoders mustn't use unitialized values in error cases

In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.

This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.

GETDEVICEINFO has the same problem.

Reported-by: Ari Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
(cherry picked from commit f961e3f2acae94b727380c0b74e2d3954d0edf79)

Orabug: 26376568
CVE: CVE-2017-8797

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
fs/nfsd/nfs4xdr.c