Commit 201cb204 authored by Chuck Lever's avatar Chuck Lever
Browse files

NFSD: Insulate nfsd4_encode_readlink() from page boundaries in the encode buffer 



There's no guarantee that the pointer returned from
xdr_reserve_space() will still point to the correct reserved space
in the encode buffer after one or more intervening calls to
xdr_reserve_space(). It just happens to work with the current
implementation of xdr_reserve_space().

Reviewed-by: default avatarNeilBrown <neilb@suse.de>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 26ea8163

fs/nfsd/nfs4xdr.c

+10 −12
Original line number Diff line number Diff line
@@ -4450,25 +4450,21 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, 
		      union nfsd4_op_u *u)

{

	struct nfsd4_readlink *readlink = &u->readlink;

	__be32 *p, *maxcount_p, zero = xdr_zero;

	__be32 *p, wire_count, zero = xdr_zero;

	struct xdr_stream *xdr = resp->xdr;

	int length_offset = xdr->buf->len;

	unsigned int length_offset;

	int maxcount, status;



	maxcount_p = xdr_reserve_space(xdr, XDR_UNIT);

	if (!maxcount_p)

	/* linktext4.count */

	length_offset = xdr->buf->len;

	if (unlikely(!xdr_reserve_space(xdr, XDR_UNIT)))

		return nfserr_resource;

	maxcount = PAGE_SIZE;



	/* linktext4.data */

	maxcount = PAGE_SIZE;

	p = xdr_reserve_space(xdr, maxcount);

	if (!p)

		return nfserr_resource;

	/*

	 * XXX: By default, vfs_readlink() will truncate symlinks if they

	 * would overflow the buffer.  Is this kosher in NFSv4?  If not, one

	 * easy fix is: if vfs_readlink() precisely fills the buffer, assume

	 * that truncation occurred, and return NFS4ERR_RESOURCE.

	 */

	nfserr = nfsd_readlink(readlink->rl_rqstp, readlink->rl_fhp,

						(char *)p, &maxcount);

	if (nfserr == nfserr_isdir)
@@ -4481,7 +4477,9 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, 
		nfserr = nfserrno(status);

		goto out_err;

	}

	*maxcount_p = cpu_to_be32(maxcount);



	wire_count = cpu_to_be32(maxcount);

	write_bytes_to_xdr_buf(xdr->buf, length_offset, &wire_count, XDR_UNIT);

	xdr_truncate_encode(xdr, length_offset + 4 + xdr_align_size(maxcount));

	write_bytes_to_xdr_buf(xdr->buf, length_offset + 4 + maxcount, &zero,

			       xdr_pad_size(maxcount));