Commit fd8235e7 authored by Chuck Lever's avatar Chuck Lever Committed by Greg Kroah-Hartman

nfsd: Limit end of page list when decoding NFSv4 WRITE

commit fc788f64 upstream.

When processing an NFSv4 WRITE operation, argp->end should never
point past the end of the data in the final page of the page list.
Otherwise, nfsd4_decode_compound can walk into uninitialized memory.

More critical, nfsd4_decode_write is failing to increment argp->pagelen
when it increments argp->pagelist.  This can cause later xdr decoders
to assume more data is available than really is, which can cause server
crashes on malformed requests.
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5ed70f7d
...@@ -129,7 +129,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp) ...@@ -129,7 +129,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp)
argp->p = page_address(argp->pagelist[0]); argp->p = page_address(argp->pagelist[0]);
argp->pagelist++; argp->pagelist++;
if (argp->pagelen < PAGE_SIZE) { if (argp->pagelen < PAGE_SIZE) {
argp->end = argp->p + (argp->pagelen>>2); argp->end = argp->p + XDR_QUADLEN(argp->pagelen);
argp->pagelen = 0; argp->pagelen = 0;
} else { } else {
argp->end = argp->p + (PAGE_SIZE>>2); argp->end = argp->p + (PAGE_SIZE>>2);
...@@ -1246,9 +1246,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write) ...@@ -1246,9 +1246,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
argp->pagelen -= pages * PAGE_SIZE; argp->pagelen -= pages * PAGE_SIZE;
len -= pages * PAGE_SIZE; len -= pages * PAGE_SIZE;
argp->p = (__be32 *)page_address(argp->pagelist[0]); next_decode_page(argp);
argp->pagelist++;
argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);
} }
argp->p += XDR_QUADLEN(len); argp->p += XDR_QUADLEN(len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment