diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2022-01-25 22:36:22 +0100 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2022-02-09 15:24:01 +0100 |
| commit | 6260d9a56ab352b54891ec66ab0eced57d55abc6 (patch) | |
| tree | 08f0fa649fbfd2676938db6885fd58a3248bbc9a /fs/nfsd/nfs4proc.c | |
| parent | NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (diff) | |
| download | linux-6260d9a56ab352b54891ec66ab0eced57d55abc6.tar.xz linux-6260d9a56ab352b54891ec66ab0eced57d55abc6.zip | |
NFSD: Clamp WRITE offsets
Ensure that a client cannot specify a WRITE range that falls in a
byte range outside what the kernel's internal types (such as loff_t,
which is signed) can represent. The kiocb iterators, invoked in
nfsd_vfs_write(), should properly limit write operations to within
the underlying file system's s_maxbytes.
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to '')
| -rw-r--r-- | fs/nfsd/nfs4proc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 71d735b125a0..b207c76a873f 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1022,8 +1022,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, unsigned long cnt; int nvecs; - if (write->wr_offset >= OFFSET_MAX) - return nfserr_inval; + if (write->wr_offset > (u64)OFFSET_MAX || + write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX) + return nfserr_fbig; cnt = write->wr_buflen; trace_nfsd_write_start(rqstp, &cstate->current_fh, |