Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fc788f64 authored by Chuck Lever's avatar Chuck Lever Committed by J. Bruce Fields
Browse files

nfsd: Limit end of page list when decoding NFSv4 WRITE 



When processing an NFSv4 WRITE operation, argp->end should never
point past the end of the data in the final page of the page list.
Otherwise, nfsd4_decode_compound can walk into uninitialized memory.

More critical, nfsd4_decode_write is failing to increment argp->pagelen
when it increments argp->pagelist.  This can cause later xdr decoders
to assume more data is available than really is, which can cause server
crashes on malformed requests.

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent eff79368

fs/nfsd/nfs4xdr.c

+2 −4
Original line number Diff line number Diff line
@@ -144,7 +144,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp) 
	argp->p = page_address(argp->pagelist[0]);

	argp->pagelist++;

	if (argp->pagelen < PAGE_SIZE) {

		argp->end = argp->p + (argp->pagelen>>2);

		argp->end = argp->p + XDR_QUADLEN(argp->pagelen);

		argp->pagelen = 0;

	} else {

		argp->end = argp->p + (PAGE_SIZE>>2);
@@ -1279,9 +1279,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write) 
		argp->pagelen -= pages * PAGE_SIZE;

		len -= pages * PAGE_SIZE;



		argp->p = (__be32 *)page_address(argp->pagelist[0]);

		argp->pagelist++;

		argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);

		next_decode_page(argp);

	}

	argp->p += XDR_QUADLEN(len);