lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NFSv4.1: Fix uninitialised variable in devicenotify

Browse Source 
[ Upstream commit b05bf5c63b326ce1da84ef42498d8e0e292e694c ]

When decode_devicenotify_args() exits with no entries, we need to
ensure that the struct cb_devicenotifyargs is initialised to
{ 0, NULL } in order to avoid problems in
nfs4_callback_devicenotify().

Reported-by: <rtm@csail.mit.edu>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Trond Myklebust 2022-01-03 14:50:16 -05:00 committed by Greg Kroah-Hartman
parent 6efe396140
commit 75e67eed75
3 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/nfs/callback.h
View File

@ -168,7 +168,7 @@ struct cb_devicenotifyitem {
}; };
struct cb_devicenotifyargs { struct cb_devicenotifyargs {
int ndevs; uint32_t ndevs;
struct cb_devicenotifyitem *devs; struct cb_devicenotifyitem *devs;
}; };

2
fs/nfs/callback_proc.c
View File

@ -364,7 +364,7 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
struct cb_process_state *cps) struct cb_process_state *cps)
{ {
struct cb_devicenotifyargs *args = argp; struct cb_devicenotifyargs *args = argp;
int i; uint32_t i;
__be32 res = 0; __be32 res = 0;
struct nfs_client *clp = cps->clp; struct nfs_client *clp = cps->clp;
struct nfs_server *server = NULL; struct nfs_server *server = NULL;

18
fs/nfs/callback_xdr.c
View File

@ -258,11 +258,9 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
void *argp) void *argp)
{ {
struct cb_devicenotifyargs *args = argp; struct cb_devicenotifyargs *args = argp;
uint32_t tmp, n, i;
__be32 *p; __be32 *p;
__be32 status = 0; __be32 status = 0;
u32 tmp;
int n, i;
args->ndevs = 0;
/* Num of device notifications */ /* Num of device notifications */
p = xdr_inline_decode(xdr, sizeof(uint32_t)); p = xdr_inline_decode(xdr, sizeof(uint32_t));
@ -271,7 +269,7 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
goto out; goto out;
} }
n = ntohl(*p++); n = ntohl(*p++);
if (n <= 0) if (n == 0)
goto out; goto out;
if (n > ULONG_MAX / sizeof(*args->devs)) { if (n > ULONG_MAX / sizeof(*args->devs)) {
status = htonl(NFS4ERR_BADXDR); status = htonl(NFS4ERR_BADXDR);
@ -330,19 +328,21 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
dev->cbd_immediate = 0; dev->cbd_immediate = 0;
} }
args->ndevs++;
dprintk("%s: type %d layout 0x%x immediate %d\n", dprintk("%s: type %d layout 0x%x immediate %d\n",
__func__, dev->cbd_notify_type, dev->cbd_layout_type, __func__, dev->cbd_notify_type, dev->cbd_layout_type,
dev->cbd_immediate); dev->cbd_immediate);
} }
args->ndevs = n;
dprintk("%s: ndevs %d\n", __func__, args->ndevs);
return 0;
err:
kfree(args->devs);
out: out:
args->devs = NULL;
args->ndevs = 0;
dprintk("%s: status %d ndevs %d\n", dprintk("%s: status %d ndevs %d\n",
__func__, ntohl(status), args->ndevs); __func__, ntohl(status), args->ndevs);
return status; return status;
err:
kfree(args->devs);
goto out;
} }
static __be32 decode_sessionid(struct xdr_stream *xdr, static __be32 decode_sessionid(struct xdr_stream *xdr,