Commit 9c2ece6e authored by Scott Mayhew's avatar Scott Mayhew Committed by J. Bruce Fields

nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir

nfsd4_readdir_rsize restricts rd_maxcount to svc_max_payload when
estimating the size of the readdir reply, but nfsd_encode_readdir
restricts it to INT_MAX when encoding the reply.  This can result in log
messages like "kernel: RPC request reserved 32896 but used 1049444".

Restrict rd_dircount similarly (no reason it should be larger than
svc_max_payload).
Signed-off-by: default avatarScott Mayhew <smayhew@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 75bc37fe
...@@ -3651,7 +3651,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4 ...@@ -3651,7 +3651,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
nfserr = nfserr_resource; nfserr = nfserr_resource;
goto err_no_verf; goto err_no_verf;
} }
maxcount = min_t(u32, readdir->rd_maxcount, INT_MAX); maxcount = svc_max_payload(resp->rqstp);
maxcount = min_t(u32, readdir->rd_maxcount, maxcount);
/* /*
* Note the rfc defines rd_maxcount as the size of the * Note the rfc defines rd_maxcount as the size of the
* READDIR4resok structure, which includes the verifier above * READDIR4resok structure, which includes the verifier above
...@@ -3665,7 +3666,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4 ...@@ -3665,7 +3666,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */ /* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */
if (!readdir->rd_dircount) if (!readdir->rd_dircount)
readdir->rd_dircount = INT_MAX; readdir->rd_dircount = svc_max_payload(resp->rqstp);
readdir->xdr = xdr; readdir->xdr = xdr;
readdir->rd_maxcount = maxcount; readdir->rd_maxcount = maxcount;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment