lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 065/530] NFSD: Protect against send buffer overflow in NFSv2 READ
    Date
    From: Chuck Lever <chuck.lever@oracle.com>

    commit 401bc1f90874280a80b93f23be33a0e7e2d1f912 upstream.

    Since before the git era, NFSD has conserved the number of pages
    held by each nfsd thread by combining the RPC receive and send
    buffers into a single array of pages. This works because there are
    no cases where an operation needs a large RPC Call message and a
    large RPC Reply at the same time.

    Once an RPC Call has been received, svc_process() updates
    svc_rqst::rq_res to describe the part of rq_pages that can be
    used for constructing the Reply. This means that the send buffer
    (rq_res) shrinks when the received RPC record containing the RPC
    Call is large.

    A client can force this shrinkage on TCP by sending a correctly-
    formed RPC Call header contained in an RPC record that is
    excessively large. The full maximum payload size cannot be
    constructed in that case.

    Cc: <stable@vger.kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/nfsd/nfsproc.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/fs/nfsd/nfsproc.c
    +++ b/fs/nfsd/nfsproc.c
    @@ -182,6 +182,7 @@ nfsd_proc_read(struct svc_rqst *rqstp)
    argp->count, argp->offset);

    argp->count = min_t(u32, argp->count, NFSSVC_MAXBLKSIZE_V2);
    + argp->count = min_t(u32, argp->count, rqstp->rq_res.buflen);

    v = 0;
    len = argp->count;

    \
     
     \ /
      Last update: 2022-10-24 16:14    [W:3.412 / U:0.784 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site