1 files changed, 14 insertions, 7 deletions

diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 426908809c97..0bafcc91c27f 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -30,6 +30,7 @@
  */
 
 #include <linux/nfs_fs.h>
+#include <linux/nfs_page.h>
 
 #include "internal.h"
 #include "nfs4filelayout.h"
@@ -552,13 +553,18 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                 __func__, nfl_util, fl->num_fh, fl->first_stripe_index,
                 fl->pattern_offset);
 
-        if (!fl->num_fh)
+        /* Note that a zero value for num_fh is legal for STRIPE_SPARSE.
+         * Futher checking is done in filelayout_check_layout */
+        if (fl->num_fh < 0 || fl->num_fh >
+            max(NFS4_PNFS_MAX_STRIPE_CNT, NFS4_PNFS_MAX_MULTI_CNT))
                 goto out_err;
 
-        fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
-                               gfp_flags);
-        if (!fl->fh_array)
-                goto out_err;
+        if (fl->num_fh > 0) {
+                fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+                                       gfp_flags);
+                if (!fl->fh_array)
+                        goto out_err;
+        }
 
         for (i = 0; i < fl->num_fh; i++) {
                 /* Do we want to use a mempool here? */
@@ -661,8 +667,9 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
         u64 p_stripe, r_stripe;
         u32 stripe_unit;
 
-        if (!pnfs_generic_pg_test(pgio, prev, req))
-                return 0;
+        if (!pnfs_generic_pg_test(pgio, prev, req) ||
+            !nfs_generic_pg_test(pgio, prev, req))
+                return false;
 
         if (!pgio->pg_lseg)
                 return 1;