Commit 00b44926 authored by Chuck Lever's avatar Chuck Lever
Browse files

NFSD: Protect against send buffer overflow in NFSv2 READDIR 



Restore the previous limit on the @count argument to prevent a
buffer overflow attack.

Fixes: 53b1119a ("NFSD: Fix READDIR buffer overflow")
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 1242a87d

fs/nfsd/nfsproc.c

+2 −3
Original line number Diff line number Diff line
@@ -567,12 +567,11 @@ static void nfsd_init_dirlist_pages(struct svc_rqst *rqstp, 
	struct xdr_buf *buf = &resp->dirlist;

	struct xdr_stream *xdr = &resp->xdr;



	count = clamp(count, (u32)(XDR_UNIT * 2), svc_max_payload(rqstp));



	memset(buf, 0, sizeof(*buf));



	/* Reserve room for the NULL ptr & eof flag (-2 words) */

	buf->buflen = count - XDR_UNIT * 2;

	buf->buflen = clamp(count, (u32)(XDR_UNIT * 2), (u32)PAGE_SIZE);

	buf->buflen -= XDR_UNIT * 2;

	buf->pages = rqstp->rq_next_page;

	rqstp->rq_next_page++;