nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir (9c2ece6e) · Commits · 戴 / test

nfsd4_readdir_rsize restricts rd_maxcount to svc_max_payload when estimating the size of the readdir reply, but nfsd_encode_readdir restricts it to INT_MAX when encoding the reply. This can result in log messages like "kernel: RPC request reserved 32896 but used 1049444". Restrict rd_dircount similarly (no reason it should be larger than svc_max_payload). Signed-off-by:

Scott Mayhew <smayhew@redhat.com> Cc: stable@vger.kernel.org Signed-off-by:

J. Bruce Fields <bfields@redhat.com>

fs/nfsd/nfs4xdr.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -3651,7 +3651,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
		nfserr = nfserr_resource;
		goto err_no_verf;
		}
		maxcount = min_t(u32, readdir->rd_maxcount, INT_MAX);
		maxcount = svc_max_payload(resp->rqstp);
		maxcount = min_t(u32, readdir->rd_maxcount, maxcount);
		/*
		* Note the rfc defines rd_maxcount as the size of the
		* READDIR4resok structure, which includes the verifier above
		@@ -3665,7 +3666,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4

		/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */
		if (!readdir->rd_dircount)
		readdir->rd_dircount = INT_MAX;
		readdir->rd_dircount = svc_max_payload(resp->rqstp);

		readdir->xdr = xdr;
		readdir->rd_maxcount = maxcount;

Admin message