Add a size check before xdr_inline_decode() is called in
decode_pnfs_layout_types() and decode_getdeviceinfo() where the length
parameter is multiplied by 4.

This check ensures that the parameter passed will not overwrap when
using 32 bit variables, avoiding incorrect size input to
xdr_inline_decode().

Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
---
 fs/nfs/nfs4xdr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index c23c2eee1b5c..5c80dfd07bba 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4902,6 +4902,8 @@ static int decode_pnfs_layout_types(struct xdr_stream *xdr,
 	/* pNFS is not supported by the underlying file system */
 	if (fsinfo->nlayouttypes == 0)
 		return 0;
+	if (fsinfo->nlayouttypes > U32_MAX / 4)
+		return -EIO;
 
 	/* Decode and set first layout type, move xdr->p past unused types */
 	p = xdr_inline_decode(xdr, fsinfo->nlayouttypes * 4);
@@ -6089,6 +6091,8 @@ static int decode_getdeviceinfo(struct xdr_stream *xdr,
 	if (len) {
 		uint32_t i;
 
+		if (len > U32_MAX / 4)
+			return -EIO;
 		p = xdr_inline_decode(xdr, 4 * len);
 		if (unlikely(!p))
 			return -EIO;

---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260819-nfsv4_u32_size_patch-ac1d4e5de336

Best regards,
--  
Griffin Kroah-Hartman <griffin@kroah.com>