diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2022-01-25 16:36:22 -0500 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2022-02-09 09:24:01 -0500 |
| commit | 6260d9a56ab352b54891ec66ab0eced57d55abc6 (patch) | |
| tree | 08f0fa649fbfd2676938db6885fd58a3248bbc9a /fs/nfsd/nfs3proc.c | |
| parent | a648fdeb7c0e17177a2280344d015dba3fbe3314 (diff) | |
| download | linux-stable-6260d9a56ab352b54891ec66ab0eced57d55abc6.tar.gz linux-stable-6260d9a56ab352b54891ec66ab0eced57d55abc6.tar.bz2 linux-stable-6260d9a56ab352b54891ec66ab0eced57d55abc6.zip | |
NFSD: Clamp WRITE offsets
Ensure that a client cannot specify a WRITE range that falls in a
byte range outside what the kernel's internal types (such as loff_t,
which is signed) can represent. The kiocb iterators, invoked in
nfsd_vfs_write(), should properly limit write operations to within
the underlying file system's s_maxbytes.
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'fs/nfsd/nfs3proc.c')
| -rw-r--r-- | fs/nfsd/nfs3proc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c index b5a52528f19f..aca38ed1526e 100644 --- a/fs/nfsd/nfs3proc.c +++ b/fs/nfsd/nfs3proc.c @@ -203,6 +203,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp) (unsigned long long) argp->offset, argp->stable? " stable" : ""); + resp->status = nfserr_fbig; + if (argp->offset > (u64)OFFSET_MAX || + argp->offset + argp->len > (u64)OFFSET_MAX) + return rpc_success; + fh_copy(&resp->fh, &argp->fh); resp->committed = argp->stable; nvecs = svc_fill_write_vector(rqstp, &argp->payload); |