From f114759c322edb4f293941a62748e31858852cd1 Mon Sep 17 00:00:00 2001 From: Trond Myklebust Date: Thu, 4 Nov 2021 17:33:36 -0400 Subject: [PATCH] NFSv4: Fix potential Oops in decode_op_map() The return value of xdr_inline_decode() is not being checked, leading to a potential Oops. Just replace the open coded array decode with the generic XDR version. Reported-by: Signed-off-by: Trond Myklebust --- fs/nfs/nfs4xdr.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index f206d41d6bee..63a12181e6c7 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -5575,20 +5575,9 @@ static int decode_secinfo_no_name(struct xdr_stream *xdr, struct nfs4_secinfo_re static int decode_op_map(struct xdr_stream *xdr, struct nfs4_op_map *op_map) { - __be32 *p; - uint32_t bitmap_words; - unsigned int i; - - p = xdr_inline_decode(xdr, 4); - if (!p) + if (xdr_stream_decode_uint32_array(xdr, op_map->u.words, + ARRAY_SIZE(op_map->u.words)) < 0) return -EIO; - bitmap_words = be32_to_cpup(p++); - if (bitmap_words > NFS4_OP_MAP_NUM_WORDS) - return -EIO; - p = xdr_inline_decode(xdr, 4 * bitmap_words); - for (i = 0; i < bitmap_words; i++) - op_map->u.words[i] = be32_to_cpup(p++); - return 0; }