Skip to content

Commit b786caa

Browse files
committed
NFSD: Insulate nfsd4_encode_secinfo() from page boundaries in the encode buffer
There's no guarantee that the pointer returned from xdr_reserve_space() will still point to the correct reserved space in the encode buffer after one or more intervening calls to xdr_reserve_space(). It just happens to work with the current implementation of xdr_reserve_space(). Reviewed-by: NeilBrown <[email protected]> Reviewed-by: Jeff Layton <[email protected]> Signed-off-by: Chuck Lever <[email protected]>
1 parent 825562b commit b786caa

File tree

1 file changed

+10
-8
lines changed

1 file changed

+10
-8
lines changed

fs/nfsd/nfs4xdr.c

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4643,13 +4643,13 @@ nfsd4_encode_secinfo4(struct xdr_stream *xdr, rpc_authflavor_t pf,
46434643
}
46444644

46454645
static __be32
4646-
nfsd4_do_encode_secinfo(struct xdr_stream *xdr, struct svc_export *exp)
4646+
nfsd4_encode_SECINFO4resok(struct xdr_stream *xdr, struct svc_export *exp)
46474647
{
46484648
u32 i, nflavs, supported;
46494649
struct exp_flavor_info *flavs;
46504650
struct exp_flavor_info def_flavs[2];
4651-
__be32 *flavorsp;
4652-
__be32 status;
4651+
unsigned int count_offset;
4652+
__be32 status, wire_count;
46534653

46544654
if (exp->ex_nflavors) {
46554655
flavs = exp->ex_flavors;
@@ -4671,8 +4671,8 @@ nfsd4_do_encode_secinfo(struct xdr_stream *xdr, struct svc_export *exp)
46714671
}
46724672
}
46734673

4674-
flavorsp = xdr_reserve_space(xdr, XDR_UNIT);
4675-
if (!flavorsp)
4674+
count_offset = xdr->buf->len;
4675+
if (unlikely(!xdr_reserve_space(xdr, XDR_UNIT)))
46764676
return nfserr_resource;
46774677

46784678
for (i = 0, supported = 0; i < nflavs; i++) {
@@ -4682,7 +4682,9 @@ nfsd4_do_encode_secinfo(struct xdr_stream *xdr, struct svc_export *exp)
46824682
return status;
46834683
}
46844684

4685-
*flavorsp = cpu_to_be32(supported);
4685+
wire_count = cpu_to_be32(supported);
4686+
write_bytes_to_xdr_buf(xdr->buf, count_offset, &wire_count,
4687+
XDR_UNIT);
46864688
return 0;
46874689
}
46884690

@@ -4693,7 +4695,7 @@ nfsd4_encode_secinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
46934695
struct nfsd4_secinfo *secinfo = &u->secinfo;
46944696
struct xdr_stream *xdr = resp->xdr;
46954697

4696-
return nfsd4_do_encode_secinfo(xdr, secinfo->si_exp);
4698+
return nfsd4_encode_SECINFO4resok(xdr, secinfo->si_exp);
46974699
}
46984700

46994701
static __be32
@@ -4703,7 +4705,7 @@ nfsd4_encode_secinfo_no_name(struct nfsd4_compoundres *resp, __be32 nfserr,
47034705
struct nfsd4_secinfo_no_name *secinfo = &u->secinfo_no_name;
47044706
struct xdr_stream *xdr = resp->xdr;
47054707

4706-
return nfsd4_do_encode_secinfo(xdr, secinfo->sin_exp);
4708+
return nfsd4_encode_SECINFO4resok(xdr, secinfo->sin_exp);
47074709
}
47084710

47094711
static __be32

0 commit comments

Comments
 (0)