From nobody Fri Dec 19 19:14:25 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90846C38A2D for ; Mon, 24 Oct 2022 20:01:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233968AbiJXUBA (ORCPT ); Mon, 24 Oct 2022 16:01:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234259AbiJXT7e (ORCPT ); Mon, 24 Oct 2022 15:59:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DB4C22537; Mon, 24 Oct 2022 11:22:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A7DE4B81886; Mon, 24 Oct 2022 12:36:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 012E6C433D7; Mon, 24 Oct 2022 12:36:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666614968; bh=/AcIXoetPdzPf4/uB9B8l2ay+aVrATiWQ9JdhKzLDAM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GcBfzeTYUQhKve6OeR1UX/h2mKdMVIixCTlcs+Jk251SnGENqKUjaSUdUXmIzgq82 5pskOUEChk4gHmzZZ+p8oPzygCiU5qSVhG2L6sqnI3w3eCwIBzGJbSub0rZnllCPOE kxzUFVdJrLcqPHQBTOm0o8R62kbYGKuSP18LE48E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Ronallo , Chuck Lever , Jeff Layton Subject: [PATCH 5.15 064/530] NFSD: Protect against send buffer overflow in NFSv3 READDIR Date: Mon, 24 Oct 2022 13:26:48 +0200 Message-Id: <20221024113047.941028770@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024113044.976326639@linuxfoundation.org> References: <20221024113044.976326639@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chuck Lever commit 640f87c190e0d1b2a0fcb2ecf6d2cd53b1c41991 upstream. Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply message at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case. Thanks to Aleksi Illikainen and Kari Hulkko for uncovering this issue. Reported-by: Ben Ronallo Cc: Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman --- fs/nfsd/nfs3proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/fs/nfsd/nfs3proc.c +++ b/fs/nfsd/nfs3proc.c @@ -447,13 +447,14 @@ static void nfsd3_init_dirlist_pages(str { struct xdr_buf *buf =3D &resp->dirlist; struct xdr_stream *xdr =3D &resp->xdr; - - count =3D clamp(count, (u32)(XDR_UNIT * 2), svc_max_payload(rqstp)); + unsigned int sendbuf =3D min_t(unsigned int, rqstp->rq_res.buflen, + svc_max_payload(rqstp)); =20 memset(buf, 0, sizeof(*buf)); =20 /* Reserve room for the NULL ptr & eof flag (-2 words) */ - buf->buflen =3D count - XDR_UNIT * 2; + buf->buflen =3D clamp(count, (u32)(XDR_UNIT * 2), sendbuf); + buf->buflen -=3D XDR_UNIT * 2; buf->pages =3D rqstp->rq_next_page; rqstp->rq_next_page +=3D (buf->buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;