[PATCH] sunrpc: fix a missing check of xdr_inline_decode

Subsystems: kernel nfsd, sunrpc, and lockd servers, networking [general], nfs, sunrpc, and lockd clients, the rest

STALE2813d

2 messages, 2 authors, 2018-12-26 · open the first message on its own page

[PATCH] sunrpc: fix a missing check of xdr_inline_decode

From: Kangjie Lu <hidden>
Date: 2018-12-26 03:18:54

xdr_inline_decode() could fail. When it fails, the return value is NULL
and should not be dereferenced.
The fix checks if xdr_inline_decode fails, and if so, returns.

Signed-off-by: Kangjie Lu <redacted>
---
 net/sunrpc/xprtrdma/backchannel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index e5b367a3e517..bd9be5272ef4 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c

@@ -285,6 +285,8 @@ void rpcrdma_bc_receive_call(struct rpcrdma_xprt *r_xprt,
 	__be32 *p;
 
 	p = xdr_inline_decode(&rep->rr_stream, 0);
+	if (unlikely(!p))
+		goto out_overflow;
 	size = xdr_stream_remaining(&rep->rr_stream);
 
 #ifdef RPCRDMA_BACKCHANNEL_DEBUG

-- 
2.17.2 (Apple Git-113)

Re: [PATCH] sunrpc: fix a missing check of xdr_inline_decode

From: Chuck Lever <hidden>
Date: 2018-12-26 17:35:37

On Dec 25, 2018, at 10:18 PM, Kangjie Lu [off-list ref] wrote:

xdr_inline_decode() could fail.

NAK: xdr_inline_decode cannot fail if its second argument is zero.

quoted hunk

When it fails, the return value is NULL
and should not be dereferenced.
The fix checks if xdr_inline_decode fails, and if so, returns.

Signed-off-by: Kangjie Lu <redacted>
---
net/sunrpc/xprtrdma/backchannel.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index e5b367a3e517..bd9be5272ef4 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c

@@ -285,6 +285,8 @@ void rpcrdma_bc_receive_call(struct rpcrdma_xprt *r_xprt,

	__be32 *p;

	p = xdr_inline_decode(&rep->rr_stream, 0);
+	if (unlikely(!p))
+		goto out_overflow;
	size = xdr_stream_remaining(&rep->rr_stream);

#ifdef RPCRDMA_BACKCHANNEL_DEBUG
-- 
2.17.2 (Apple Git-113)

--
Chuck Lever

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help