Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx> --- fs/nfsd/nfs4xdr.c | 68 +++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 47 insertions(+), 21 deletions(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index c48fa1427421..91f2612b3d2c 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -1889,37 +1889,63 @@ nfsd4_decode_layoutget(struct nfsd4_compoundargs *argp, } static __be32 -nfsd4_decode_layoutreturn(struct nfsd4_compoundargs *argp, - struct nfsd4_layoutreturn *lrp) +nfsd4_decode_layoutreturn4(struct nfsd4_compoundargs *argp, + struct nfsd4_layoutreturn *lrp) { - DECODE_HEAD; - - READ_BUF(16); - lrp->lr_reclaim = be32_to_cpup(p++); - lrp->lr_layout_type = be32_to_cpup(p++); - lrp->lr_seg.iomode = be32_to_cpup(p++); - lrp->lr_return_type = be32_to_cpup(p++); - if (lrp->lr_return_type == RETURN_FILE) { - READ_BUF(16); - p = xdr_decode_hyper(p, &lrp->lr_seg.offset); - p = xdr_decode_hyper(p, &lrp->lr_seg.length); + __be32 status; + if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_return_type) < 0) + goto xdr_error; + switch (lrp->lr_return_type) { + case RETURN_FILE: + if (xdr_stream_decode_u64(argp->xdr, &lrp->lr_seg.offset) < 0) + goto xdr_error; + if (xdr_stream_decode_u64(argp->xdr, &lrp->lr_seg.length) < 0) + goto xdr_error; status = nfsd4_decode_stateid4(argp, &lrp->lr_sid); if (status) - return status; - - READ_BUF(4); - lrp->lrf_body_len = be32_to_cpup(p++); + goto out; + if (xdr_stream_decode_u32(argp->xdr, &lrp->lrf_body_len) < 0) + goto xdr_error; if (lrp->lrf_body_len > 0) { - READ_BUF(lrp->lrf_body_len); - READMEM(lrp->lrf_body, lrp->lrf_body_len); + lrp->lrf_body = xdr_inline_decode(argp->xdr, lrp->lrf_body_len); + if (!lrp->lrf_body) + goto xdr_error; } - } else { + break; + case RETURN_FSID: + case RETURN_ALL: lrp->lr_seg.offset = 0; lrp->lr_seg.length = NFS4_MAX_UINT64; + break; + default: + goto xdr_error; } - DECODE_TAIL; + status = nfs_ok; +out: + return status; +xdr_error: + return nfserr_bad_xdr; +} + +static __be32 +nfsd4_decode_layoutreturn(struct nfsd4_compoundargs *argp, + struct nfsd4_layoutreturn *lrp) +{ + __be32 *p; + + p = xdr_inline_decode(argp->xdr, sizeof(__be32)); + if (!p) + goto xdr_error; + lrp->lr_reclaim = (*p == xdr_zero) ? 0 : 1; + if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_layout_type) < 0) + goto xdr_error; + if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_seg.iomode) < 0) + goto xdr_error; + return nfsd4_decode_layoutreturn4(argp, lrp); +xdr_error: + return nfserr_bad_xdr; } #endif /* CONFIG_NFSD_PNFS */