• C
    nfsd: Limit end of page list when decoding NFSv4 WRITE · fc788f64
    Chuck Lever 提交于
    When processing an NFSv4 WRITE operation, argp->end should never
    point past the end of the data in the final page of the page list.
    Otherwise, nfsd4_decode_compound can walk into uninitialized memory.
    
    More critical, nfsd4_decode_write is failing to increment argp->pagelen
    when it increments argp->pagelist.  This can cause later xdr decoders
    to assume more data is available than really is, which can cause server
    crashes on malformed requests.
    Signed-off-by: NChuck Lever <chuck.lever@oracle.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
    fc788f64
nfs4xdr.c 115.0 KB