summaryrefslogtreecommitdiffstats
path: root/net/sunrpc/svc.c
diff options
context:
space:
mode:
authorBenjamin Coddington <bcodding@redhat.com>2015-11-20 09:55:30 -0500
committerTrond Myklebust <trond.myklebust@primarydata.com>2015-11-23 22:03:15 -0500
commit38b7631fbe42e6e247e9fc9879f961b14a687e3b (patch)
treeedcf8b437182b980a936bc11a46a292c31173c7f /net/sunrpc/svc.c
parentc68a027c05709330fe5b2f50c50d5fa02124b5d8 (diff)
downloadlinux-38b7631fbe42e6e247e9fc9879f961b14a687e3b.tar.gz
linux-38b7631fbe42e6e247e9fc9879f961b14a687e3b.tar.bz2
linux-38b7631fbe42e6e247e9fc9879f961b14a687e3b.zip
nfs4: limit callback decoding to received bytes
A truncated cb_compound request will cause the client to decode null or data from a previous callback for nfs4.1 backchannel case, or uninitialized data for the nfs4.0 case. This is because the path through svc_process_common() advances the request's iov_base and decrements iov_len without adjusting the overall xdr_buf's len field. That causes xdr_init_decode() to set up the xdr_stream with an incorrect length in nfs4_callback_compound(). Fixing this for the nfs4.1 backchannel case first requires setting the correct iov_len and page_len based on the length of received data in the same manner as the nfs4.0 case. Then the request's xdr_buf length can be adjusted for both cases based upon the remaining iov_len and page_len. Signed-off-by: Benjamin Coddington <bcodding@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Diffstat (limited to 'net/sunrpc/svc.c')
-rw-r--r--net/sunrpc/svc.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index bc5b7b5032ca..7fccf9675df8 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1363,6 +1363,7 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
memcpy(&rqstp->rq_arg, &req->rq_rcv_buf, sizeof(rqstp->rq_arg));
memcpy(&rqstp->rq_res, &req->rq_snd_buf, sizeof(rqstp->rq_res));
+ rqstp->rq_arg.len = req->rq_private_buf.len;
/* reset result send buffer "put" position */
resv->iov_len = 0;