nfsd: encoders mustn't use unitialized values in error cases

commit f961e3f2acae94b727380c0b74e2d3954d0edf79 upstream.

In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.

This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.

GETDEVICEINFO has the same problem.

Reported-by: Ari Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 4 insertions, 4 deletions

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index c2d2895a1ec1..2ee80e1f5230 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -4081,8 +4081,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
                 struct nfsd4_getdeviceinfo *gdev)
 {
         struct xdr_stream *xdr = &resp->xdr;
-        const struct nfsd4_layout_ops *ops =
-                nfsd4_layout_ops[gdev->gd_layout_type];
+        const struct nfsd4_layout_ops *ops;
         u32 starting_len = xdr->buf->len, needed_len;
         __be32 *p;
 
@@ -4099,6 +4098,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
 
         /* If maxcount is 0 then just update notifications */
         if (gdev->gd_maxcount != 0) {
+                ops = nfsd4_layout_ops[gdev->gd_layout_type];
                 nfserr = ops->encode_getdeviceinfo(xdr, gdev);
                 if (nfserr) {
                         /*
@@ -4151,8 +4151,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
                 struct nfsd4_layoutget *lgp)
 {
         struct xdr_stream *xdr = &resp->xdr;
-        const struct nfsd4_layout_ops *ops =
-                nfsd4_layout_ops[lgp->lg_layout_type];
+        const struct nfsd4_layout_ops *ops;
         __be32 *p;
 
         dprintk("%s: err %d\n", __func__, nfserr);
@@ -4175,6 +4174,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
         *p++ = cpu_to_be32(lgp->lg_seg.iomode);
         *p++ = cpu_to_be32(lgp->lg_layout_type);
 
+        ops = nfsd4_layout_ops[lgp->lg_layout_type];
         nfserr = ops->encode_layoutget(xdr, lgp);
 out:
         kfree(lgp->lg_content);