leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rpc: fix xdr_truncate_encode to handle buffer ending on page boundary

Browse Source 
A struct xdr_stream at a page boundary might point to the end of one
page or the beginning of the next, but xdr_truncate_encode isn't
prepared to handle the former.

This can cause corruption of NFSv4 READDIR replies in the case that a
readdir entry that would have exceeded the client's dircount/maxcount
limit would have ended exactly on a 4k page boundary.  You're more
likely to hit this case on large directories.

Other xdr_truncate_encode callers are probably also affected.

Reported-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
Tested-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
Fixes: 3e19ce762b "rpc: xdr_truncate_encode"
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
J. Bruce Fields 2014-12-22 16:14:51 -05:00
parent 94ae1db226
commit 49a068f82a
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/sunrpc/xdr.c
View File

@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
struct kvec *head = buf->head; struct kvec *head = buf->head;
struct kvec *tail = buf->tail; struct kvec *tail = buf->tail;
int fraglen; int fraglen;
int new, old; int new;
if (len > buf->len) { if (len > buf->len) {
WARN_ON_ONCE(1); WARN_ON_ONCE(1);
@ -629,8 +629,8 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
buf->len -= fraglen; buf->len -= fraglen;
new = buf->page_base + buf->page_len; new = buf->page_base + buf->page_len;
old = new + fraglen;
xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT); xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
if (buf->page_len) { if (buf->page_len) {
xdr->p = page_address(*xdr->page_ptr); xdr->p = page_address(*xdr->page_ptr);