]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
authorChuck Lever <chuck.lever@oracle.com>
Fri, 31 Mar 2023 20:31:19 +0000 (16:31 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Apr 2023 15:02:37 +0000 (17:02 +0200)
commitf352c41fa718482979e7e6b71b4da2b718e381cc
tree05d6db447058deb332cf58cdd7dd164672f57792
parent5ef2db5889da1943cba79aa6f97e767ab938dccc
NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

[ Upstream commit 804d8e0a6e54427268790472781e03bc243f4ee3 ]

OPDESC() simply indexes into nfsd4_ops[] by the op's operation
number, without range checking that value. It assumes callers are
careful to avoid calling it with an out-of-bounds opnum value.

nfsd4_decode_compound() is not so careful, and can invoke OPDESC()
with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end
of nfsd4_ops[].

Reported-by: Jeff Layton <jlayton@kernel.org>
Fixes: f4f9ef4a1b0a ("nfsd4: opdesc will be useful outside nfs4proc.c")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/nfsd/nfs4xdr.c