github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 05:55:44 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

NFSD: Clamp WRITE offsets

Browse Source 
commit 6260d9a56a upstream.

Ensure that a client cannot specify a WRITE range that falls in a
byte range outside what the kernel's internal types (such as loff_t,
which is signed) can represent. The kiocb iterators, invoked in
nfsd_vfs_write(), should properly limit write operations to within
the underlying file system's s_maxbytes.

Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Chuck Lever 2022-01-25 16:36:22 -05:00 committed by Greg Kroah-Hartman
parent c72f7c2ec3
commit 3a6a2d43e3
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/nfsd/nfs3proc.c
View File

@ -183,6 +183,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp)
(unsigned long long) argp->offset, (unsigned long long) argp->offset,
argp->stable? " stable" : ""); argp->stable? " stable" : "");
resp->status = nfserr_fbig;
if (argp->offset > (u64)OFFSET_MAX ||
argp->offset + argp->len > (u64)OFFSET_MAX)
return rpc_success;
fh_copy(&resp->fh, &argp->fh); fh_copy(&resp->fh, &argp->fh);
resp->committed = argp->stable; resp->committed = argp->stable;
nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages, nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages,

5
fs/nfsd/nfs4proc.c
View File

@ -1008,8 +1008,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
unsigned long cnt; unsigned long cnt;
int nvecs; int nvecs;
if (write->wr_offset >= OFFSET_MAX) if (write->wr_offset > (u64)OFFSET_MAX ||
return nfserr_inval; write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX)
return nfserr_fbig;
cnt = write->wr_buflen; cnt = write->wr_buflen;
trace_nfsd_write_start(rqstp, &cstate->current_fh, trace_nfsd_write_start(rqstp, &cstate->current_fh,