Commit 804d8e0a authored by Chuck Lever's avatar Chuck Lever

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

OPDESC() simply indexes into nfsd4_ops[] by the op's operation
number, without range checking that value. It assumes callers are
careful to avoid calling it with an out-of-bounds opnum value.

nfsd4_decode_compound() is not so careful, and can invoke OPDESC()
with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end
of nfsd4_ops[].
Reported-by: default avatarJeff Layton <jlayton@kernel.org>
Fixes: f4f9ef4a ("nfsd4: opdesc will be useful outside nfs4proc.c")
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 5f24a872
...@@ -2476,10 +2476,12 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) ...@@ -2476,10 +2476,12 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
for (i = 0; i < argp->opcnt; i++) { for (i = 0; i < argp->opcnt; i++) {
op = &argp->ops[i]; op = &argp->ops[i];
op->replay = NULL; op->replay = NULL;
op->opdesc = NULL;
if (xdr_stream_decode_u32(argp->xdr, &op->opnum) < 0) if (xdr_stream_decode_u32(argp->xdr, &op->opnum) < 0)
return false; return false;
if (nfsd4_opnum_in_range(argp, op)) { if (nfsd4_opnum_in_range(argp, op)) {
op->opdesc = OPDESC(op);
op->status = nfsd4_dec_ops[op->opnum](argp, &op->u); op->status = nfsd4_dec_ops[op->opnum](argp, &op->u);
if (op->status != nfs_ok) if (op->status != nfs_ok)
trace_nfsd_compound_decode_err(argp->rqstp, trace_nfsd_compound_decode_err(argp->rqstp,
...@@ -2490,7 +2492,7 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) ...@@ -2490,7 +2492,7 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
op->opnum = OP_ILLEGAL; op->opnum = OP_ILLEGAL;
op->status = nfserr_op_illegal; op->status = nfserr_op_illegal;
} }
op->opdesc = OPDESC(op);
/* /*
* We'll try to cache the result in the DRC if any one * We'll try to cache the result in the DRC if any one
* op in the compound wants to be cached: * op in the compound wants to be cached:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment