diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2017-08-18 15:12:19 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-08-30 08:21:50 (GMT) |
| commit | fd8235e721ef8bb15ba390d9f2f806f794368536 (patch) | |
| tree | b1b6c3e68b0d2fe63c23bca2202ceb4401d21d13 /kernel | |
| parent | 5ed70f7db9afe5e4e5cc1fa2239676e3b2d2c5b2 (diff) | |
| download | linux-fd8235e721ef8bb15ba390d9f2f806f794368536.tar.xz | |
nfsd: Limit end of page list when decoding NFSv4 WRITE
commit fc788f64f1f3eb31e87d4f53bcf1ab76590d5838 upstream.
When processing an NFSv4 WRITE operation, argp->end should never
point past the end of the data in the final page of the page list.
Otherwise, nfsd4_decode_compound can walk into uninitialized memory.
More critical, nfsd4_decode_write is failing to increment argp->pagelen
when it increments argp->pagelist. This can cause later xdr decoders
to assume more data is available than really is, which can cause server
crashes on malformed requests.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions