Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 626fb932 authored by Scott Mayhew's avatar Scott Mayhew Committed by Greg Kroah-Hartman
Browse files

nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir 



commit 9c2ece6ef67e9d376f32823086169b489c422ed0 upstream.

nfsd4_readdir_rsize restricts rd_maxcount to svc_max_payload when
estimating the size of the readdir reply, but nfsd_encode_readdir
restricts it to INT_MAX when encoding the reply.  This can result in log
messages like "kernel: RPC request reserved 32896 but used 1049444".

Restrict rd_dircount similarly (no reason it should be larger than
svc_max_payload).

Signed-off-by: default avatarScott Mayhew <smayhew@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ea5c4686

fs/nfsd/nfs4xdr.c

+3 −2
Original line number Diff line number Diff line
@@ -3358,7 +3358,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4 
		nfserr = nfserr_resource;

		goto err_no_verf;

	}

	maxcount = min_t(u32, readdir->rd_maxcount, INT_MAX);

	maxcount = svc_max_payload(resp->rqstp);

	maxcount = min_t(u32, readdir->rd_maxcount, maxcount);

	/*

	 * Note the rfc defines rd_maxcount as the size of the

	 * READDIR4resok structure, which includes the verifier above
@@ -3372,7 +3373,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4 


	/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */

	if (!readdir->rd_dircount)

		readdir->rd_dircount = INT_MAX;

		readdir->rd_dircount = svc_max_payload(resp->rqstp);



	readdir->xdr = xdr;

	readdir->rd_maxcount = maxcount;