]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit - fs/nfsd/nfs4xdr.c
nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
authorScott Mayhew <smayhew@redhat.com>
Mon, 7 May 2018 13:01:08 +0000 (09:01 -0400)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Mon, 14 Jan 2019 09:28:55 +0000 (09:28 +0000)
commitbcac207d0738a1c714abf33a96d93577b13bbc31
tree023af74dda4f3784e8e2dcd623b74b164f16fd31
parentbca018b3e1bddfe61023c9879b68c900f69efdc3
nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir

BugLink: http://bugs.launchpad.net/bugs/1807469
commit 9c2ece6ef67e9d376f32823086169b489c422ed0 upstream.

nfsd4_readdir_rsize restricts rd_maxcount to svc_max_payload when
estimating the size of the readdir reply, but nfsd_encode_readdir
restricts it to INT_MAX when encoding the reply.  This can result in log
messages like "kernel: RPC request reserved 32896 but used 1049444".

Restrict rd_dircount similarly (no reason it should be larger than
svc_max_payload).

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
fs/nfsd/nfs4xdr.c