Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
NFSD: Insulate nfsd4_encode_secinfo() from page boundaries in the encode buffer
There's no guarantee that the pointer returned from
xdr_reserve_space() will still point to the correct reserved space
in the encode buffer after one or more intervening calls to
xdr_reserve_space(). It just happens to work with the current
implementation of xdr_reserve_space().
Reviewed-by: NeilBrown <neilb@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+10
-8
+10
-8
fs/nfsd/nfs4xdr.c
+10
-8
fs/nfsd/nfs4xdr.c
···
4643
4643
}
4644
4644
4645
4645
static __be32
4646
-
nfsd4_do_encode_secinfo(struct xdr_stream *xdr, struct svc_export *exp)
4646
+
nfsd4_encode_SECINFO4resok(struct xdr_stream *xdr, struct svc_export *exp)
4647
4647
{
4648
4648
u32 i, nflavs, supported;
4649
4649
struct exp_flavor_info *flavs;
4650
4650
struct exp_flavor_info def_flavs[2];
4651
-
__be32 *flavorsp;
4652
-
__be32 status;
4651
+
unsigned int count_offset;
4652
+
__be32 status, wire_count;
4653
4653
4654
4654
if (exp->ex_nflavors) {
4655
4655
flavs = exp->ex_flavors;
···
4671
4671
}
4672
4672
}
4673
4673
4674
-
flavorsp = xdr_reserve_space(xdr, XDR_UNIT);
4675
-
if (!flavorsp)
4674
+
count_offset = xdr->buf->len;
4675
+
if (unlikely(!xdr_reserve_space(xdr, XDR_UNIT)))
4676
4676
return nfserr_resource;
4677
4677
4678
4678
for (i = 0, supported = 0; i < nflavs; i++) {
···
4682
4682
return status;
4683
4683
}
4684
4684
4685
-
*flavorsp = cpu_to_be32(supported);
4685
+
wire_count = cpu_to_be32(supported);
4686
+
write_bytes_to_xdr_buf(xdr->buf, count_offset, &wire_count,
4687
+
XDR_UNIT);
4686
4688
return 0;
4687
4689
}
4688
4690
···
4695
4693
struct nfsd4_secinfo *secinfo = &u->secinfo;
4696
4694
struct xdr_stream *xdr = resp->xdr;
4697
4695
4698
-
return nfsd4_do_encode_secinfo(xdr, secinfo->si_exp);
4696
+
return nfsd4_encode_SECINFO4resok(xdr, secinfo->si_exp);
4699
4697
}
4700
4698
4701
4699
static __be32
···
4705
4703
struct nfsd4_secinfo_no_name *secinfo = &u->secinfo_no_name;
4706
4704
struct xdr_stream *xdr = resp->xdr;
4707
4705
4708
-
return nfsd4_do_encode_secinfo(xdr, secinfo->sin_exp);
4706
+
return nfsd4_encode_SECINFO4resok(xdr, secinfo->sin_exp);
4709
4707
}
4710
4708
4711
4709
static __be32