---

yaml --- r: 229233 b: refs/heads/master c: fc1794c h: refs/heads/master i: 229231: 2729df3 v: v3
git-mirror · Jan 6, 2011 · 1622469 · 1622469
1 parent beb433d
commit 1622469
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 2130ff663633e8a57921779ebfe62fc39d5585ec
+refs/heads/master: fc1794c5b04f5322bad05385cd91b52ec85aab72
diff --git a/trunk/fs/nfs/pnfs.c b/trunk/fs/nfs/pnfs.c
@@ -660,6 +660,17 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
 	struct inode *ino = lo->plh_inode;
 	int status = 0;
 
+	/* Verify we got what we asked for.
+	 * Note that because the xdr parsing only accepts a single
+	 * element array, this can fail even if the server is behaving
+	 * correctly.
+	 */
+	if (lgp->args.range.iomode > res->range.iomode ||
+	    res->range.offset != 0 ||
+	    res->range.length != NFS4_MAX_UINT64) {
+		status = -EINVAL;
+		goto out;
+	}
 	/* Inject layout blob into I/O device driver */
 	lseg = NFS_SERVER(ino)->pnfs_curr_ld->alloc_lseg(lo, res);
 	if (!lseg || IS_ERR(lseg)) {