diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2020-10-31 19:44:25 +0300 |
|---|---|---|
| committer | Anna Schumaker <Anna.Schumaker@Netapp.com> | 2020-11-12 18:41:26 +0300 |
| commit | 6c2190b3fcbc92cb79e39cc7e7531656b341e463 (patch) | |
| tree | 657781a7bb0f2022ba09cac01cbc6b45990f127c /lib/test_overflow.c | |
| parent | 70438afbf17e5194dd607dd17759560a363b7bb4 (diff) | |
| download | linux-6c2190b3fcbc92cb79e39cc7e7531656b341e463.tar.xz | |
NFS: Fix listxattr receive buffer size
Certain NFSv4.2/RDMA tests fail with v5.9-rc1.
rpcrdma_convert_kvec() runs off the end of the rl_segments array
because rq_rcv_buf.tail[0].iov_len holds a very large positive
value. The resultant kernel memory corruption is enough to crash
the client system.
Callers of rpc_prepare_reply_pages() must reserve an extra XDR_UNIT
in the maximum decode size for a possible XDR pad of the contents
of the xdr_buf's pages. That guarantees the allocated receive buffer
will be large enough to accommodate the usual contents plus that XDR
pad word.
encode_op_hdr() cannot add that extra word. If it does,
xdr_inline_pages() underruns the length of the tail iovec.
Fixes: 3e1f02123fba ("NFSv4.2: add client side XDR handling for extended attributes")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Diffstat (limited to 'lib/test_overflow.c')
0 files changed, 0 insertions, 0 deletions