Commit 5650682e authored by Chuck Lever's avatar Chuck Lever
Browse files

NFSD: Remove argument length checking in nfsd_dispatch() 



Now that the argument decoders for NFSv2 and NFSv3 use the
xdr_stream mechanism, the version-specific length checking logic in
nfsd_dispatch() is no longer necessary.

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 09f75a53

fs/nfsd/nfssvc.c

+0 −34
Original line number Diff line number Diff line
@@ -955,37 +955,6 @@ nfsd(void *vrqstp) 
	return 0;

}



/*

 * A write procedure can have a large argument, and a read procedure can

 * have a large reply, but no NFSv2 or NFSv3 procedure has argument and

 * reply that can both be larger than a page.  The xdr code has taken

 * advantage of this assumption to be a sloppy about bounds checking in

 * some cases.  Pending a rewrite of the NFSv2/v3 xdr code to fix that

 * problem, we enforce these assumptions here:

 */

static bool nfs_request_too_big(struct svc_rqst *rqstp,

				const struct svc_procedure *proc)

{

	/*

	 * The ACL code has more careful bounds-checking and is not

	 * susceptible to this problem:

	 */

	if (rqstp->rq_prog != NFS_PROGRAM)

		return false;

	/*

	 * Ditto NFSv4 (which can in theory have argument and reply both

	 * more than a page):

	 */

	if (rqstp->rq_vers >= 4)

		return false;

	/* The reply will be small, we're OK: */

	if (proc->pc_xdrressize > 0 &&

	    proc->pc_xdrressize < XDR_QUADLEN(PAGE_SIZE))

		return false;



	return rqstp->rq_arg.len > PAGE_SIZE;

}



/**

 * nfsd_dispatch - Process an NFS or NFSACL Request

 * @rqstp: incoming request
@@ -1004,9 +973,6 @@ int nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp) 
	struct kvec *resv = &rqstp->rq_res.head[0];

	__be32 *p;



	if (nfs_request_too_big(rqstp, proc))

		goto out_decode_err;



	/*

	 * Give the xdr decoder a chance to change this if it wants

	 * (necessary in the NFSv4.0 compound case)