Commit 31e4bb8f authored by Jorge Mora's avatar Jorge Mora Committed by Chuck Lever

NFSD: fix LISTXATTRS returning more bytes than maxcount

The maxcount is the maximum number of bytes for the LISTXATTRS4resok
result. This includes the cookie and the count for the name array,
thus subtract 12 bytes from the maxcount: 8 (cookie) + 4 (array count)
when filling up the name array.

Fixes: 23e50fe3 ("nfsd: implement the xattr functions and en/decode logic")
Signed-off-by: default avatarJorge Mora <mora@netapp.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 2f73f37d
...@@ -5423,7 +5423,7 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr, ...@@ -5423,7 +5423,7 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
*/ */
cookie_offset = xdr->buf->len; cookie_offset = xdr->buf->len;
count_offset = cookie_offset + 8; count_offset = cookie_offset + 8;
p = xdr_reserve_space(xdr, 12); p = xdr_reserve_space(xdr, XDR_UNIT * 3);
if (!p) { if (!p) {
status = nfserr_resource; status = nfserr_resource;
goto out; goto out;
...@@ -5434,7 +5434,8 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr, ...@@ -5434,7 +5434,8 @@ nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
sp = listxattrs->lsxa_buf; sp = listxattrs->lsxa_buf;
nuser = 0; nuser = 0;
xdrleft = listxattrs->lsxa_maxcount; /* Bytes left is maxcount - 8 (cookie) - 4 (array count) */
xdrleft = listxattrs->lsxa_maxcount - XDR_UNIT * 3;
while (left > 0 && xdrleft > 0) { while (left > 0 && xdrleft > 0) {
slen = strlen(sp); slen = strlen(sp);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment