• Benjamin Coddington's avatar
    nfs4: limit callback decoding to received bytes · 38b7631f
    Benjamin Coddington authored
    A truncated cb_compound request will cause the client to decode null or
    data from a previous callback for nfs4.1 backchannel case, or uninitialized
    data for the nfs4.0 case. This is because the path through
    svc_process_common() advances the request's iov_base and decrements iov_len
    without adjusting the overall xdr_buf's len field.  That causes
    xdr_init_decode() to set up the xdr_stream with an incorrect length in
    nfs4_callback_compound().
    
    Fixing this for the nfs4.1 backchannel case first requires setting the
    correct iov_len and page_len based on the length of received data in the
    same manner as the nfs4.0 case.
    
    Then the request's xdr_buf length can be adjusted for both cases based upon
    the remaining iov_len and page_len.
    Signed-off-by: default avatarBenjamin Coddington <bcodding@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
    38b7631f
callback_xdr.c 25.9 KB