On Fri, Aug 18, 2017 at 11:12:19AM -0400, Chuck Lever wrote:
> When processing an NFSv4 WRITE operation, argp->end should never
> point past the end of the data in the final page of the page list.
> Otherwise, nfsd4_decode_compound can walk into uninitialized memory.
>
> Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
> ---
> fs/nfsd/nfs4xdr.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index 51e729a..7c48d68 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -144,7 +144,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp)
> argp->p = page_address(argp->pagelist[0]);
> argp->pagelist++;
> if (argp->pagelen < PAGE_SIZE) {
> - argp->end = argp->p + (argp->pagelen>>2);
> + argp->end = argp->p + XDR_QUADLEN(argp->pagelen);
> argp->pagelen = 0;
> } else {
> argp->end = argp->p + (PAGE_SIZE>>2);
> @@ -1279,9 +1279,7 @@ static __be32 nfsd4_decode_opaque(struct nfsd4_compoundargs *argp, struct xdr_ne
> argp->pagelen -= pages * PAGE_SIZE;
> len -= pages * PAGE_SIZE;
>
> - argp->p = (__be32 *)page_address(argp->pagelist[0]);
> - argp->pagelist++;
> - argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);
> + next_decode_page(argp);
I think there's no change in behavior here *except* for adding a new
argp->pagelen=0 (or argp->pagelen -= PAGE_SIZE).
--b.
> }
> argp->p += XDR_QUADLEN(len);
>
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
