pnfs/blocklayout: reject too long signatures

Instead of overwriting kernel memory reject too long signatures.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>

diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
index e535599a07191619c28eba93342388a59267114e..d76993a424322d122102a9fb2eff4bf88a68aad6 100644 (file)
--- a/fs/nfs/blocklayout/dev.c
+++ b/fs/nfs/blocklayout/dev.c
@@ -65,6 +65,11 @@ nfs4_block_decode_volume(struct xdr_stream *xdr, struct pnfs_block_volume *b)
                                return -EIO;
                        p = xdr_decode_hyper(p, &b->simple.sigs[i].offset);
                        b->simple.sigs[i].sig_len = be32_to_cpup(p++);
+                       if (b->simple.sigs[i].sig_len > PNFS_BLOCK_UUID_LEN) {
+                               pr_info("signature too long: %d\n",
+                                       b->simple.sigs[i].sig_len);
+                               return -EIO;
+                       }
 
                        p = xdr_inline_decode(xdr, b->simple.sigs[i].sig_len);
                        if (!p)