Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6aa102df authored by Chuck Lever's avatar Chuck Lever Committed by Pavel Machek
Browse files

NFSD: Clamp WRITE offsets 



commit 6260d9a56ab352b54891ec66ab0eced57d55abc6 upstream.

Ensure that a client cannot specify a WRITE range that falls in a
byte range outside what the kernel's internal types (such as loff_t,
which is signed) can represent. The kiocb iterators, invoked in
nfsd_vfs_write(), should properly limit write operations to within
the underlying file system's s_maxbytes.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a3046690

fs/nfsd/nfs3proc.c

+5 −0
Original line number Diff line number Diff line
@@ -190,6 +190,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp, struct nfsd3_writeargs *argp, 
				(unsigned long long) argp->offset,

				argp->stable? " stable" : "");



	resp->status = nfserr_fbig;

	if (argp->offset > (u64)OFFSET_MAX ||

	    argp->offset + argp->len > (u64)OFFSET_MAX)

		return rpc_success;



	fh_copy(&resp->fh, &argp->fh);

	resp->committed = argp->stable;

	nfserr = nfsd_write(rqstp, &resp->fh, NULL,

fs/nfsd/nfs4proc.c

+3 −2
Original line number Diff line number Diff line
@@ -983,8 +983,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
	unsigned long cnt;

	int nvecs;



	if (write->wr_offset >= OFFSET_MAX)

		return nfserr_inval;

	if (write->wr_offset > (u64)OFFSET_MAX ||

	    write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX)

		return nfserr_fbig;



	status = nfs4_preprocess_stateid_op(rqstp, cstate, stateid, WR_STATE,

			&filp, NULL);