From: Chuck Lever <chuck.lever@oracle.com>
To: linux-nfs@vger.kernel.org
Subject: [PATCH v3 2/6] SUNRPC: Fix svcxdr_init_encode's buflen calculation
Date: Thu, 01 Sep 2022 15:09:59 -0400 [thread overview]
Message-ID: <166205939934.1435.10147129980334935811.stgit@manet.1015granger.net> (raw)
In-Reply-To: <166204973526.1435.6068003336048840051.stgit@manet.1015granger.net>
Commit 2825a7f90753 ("nfsd4: allow encoding across page boundaries")
added an explicit computation of the remaining length in the rq_res
XDR buffer.
The computation appears to suffer from an "off-by-one" bug. Because
buflen is too large by one page, XDR encoding can run off the end of
the send buffer by eventually trying to use the struct page address
in rq_page_end, which always contains NULL.
Fixes: bddfdbcddbe2 ("NFSD: Extract the svcxdr_init_encode() helper")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
include/linux/sunrpc/svc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 5a830b66f059..0ca8a8ffb47e 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -587,7 +587,7 @@ static inline void svcxdr_init_encode(struct svc_rqst *rqstp)
xdr->end = resv->iov_base + PAGE_SIZE - rqstp->rq_auth_slack;
buf->len = resv->iov_len;
xdr->page_ptr = buf->pages - 1;
- buf->buflen = PAGE_SIZE * (1 + rqstp->rq_page_end - buf->pages);
+ buf->buflen = PAGE_SIZE * (rqstp->rq_page_end - buf->pages);
buf->buflen -= rqstp->rq_auth_slack;
xdr->rqst = NULL;
}
next prev parent reply other threads:[~2022-09-01 19:10 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-01 19:09 [PATCH v3 0/6] Fixes for server-side xdr_stream overhaul Chuck Lever
2022-09-01 19:09 ` [PATCH v3 1/6] SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation Chuck Lever
2022-09-01 19:09 ` Chuck Lever [this message]
2022-09-01 19:10 ` [PATCH v3 3/6] NFSD: Protect against send buffer overflow in NFSv2 READDIR Chuck Lever
2022-09-02 13:09 ` Jeff Layton
2022-09-01 19:10 ` [PATCH v3 4/6] NFSD: Protect against send buffer overflow in NFSv3 READDIR Chuck Lever
2022-09-02 13:12 ` Jeff Layton
2022-09-01 19:10 ` [PATCH v3 5/6] NFSD: Protect against send buffer overflow in NFSv2 READ Chuck Lever
2022-09-02 13:14 ` Jeff Layton
2022-09-01 19:10 ` [PATCH v3 6/6] NFSD: Protect against send buffer overflow in NFSv3 READ Chuck Lever
2022-09-02 13:15 ` Jeff Layton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=166205939934.1435.10147129980334935811.stgit@manet.1015granger.net \
--to=chuck.lever@oracle.com \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.