|
@@ -1918,8 +1918,13 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
|
|
|
|
|
|
if (argp->taglen > NFSD4_MAX_TAGLEN)
|
|
if (argp->taglen > NFSD4_MAX_TAGLEN)
|
|
goto xdr_error;
|
|
goto xdr_error;
|
|
- if (argp->opcnt > 100)
|
|
|
|
- goto xdr_error;
|
|
|
|
|
|
+ /*
|
|
|
|
+ * NFS4ERR_RESOURCE is a more helpful error than GARBAGE_ARGS
|
|
|
|
+ * here, so we return success at the xdr level so that
|
|
|
|
+ * nfsd4_proc can handle this is an NFS-level error.
|
|
|
|
+ */
|
|
|
|
+ if (argp->opcnt > NFSD_MAX_OPS_PER_COMPOUND)
|
|
|
|
+ return 0;
|
|
|
|
|
|
if (argp->opcnt > ARRAY_SIZE(argp->iops)) {
|
|
if (argp->opcnt > ARRAY_SIZE(argp->iops)) {
|
|
argp->ops = kzalloc(argp->opcnt * sizeof(*argp->ops), GFP_KERNEL);
|
|
argp->ops = kzalloc(argp->opcnt * sizeof(*argp->ops), GFP_KERNEL);
|