From 3cab1c951fbb09d5787d2492ca1b3ec8e66eab95 Mon Sep 17 00:00:00 2001 From: Trond Myklebust Date: Wed, 19 May 2004 22:02:07 -0700 Subject: [PATCH] [PATCH] Fix NFS long symlinks checks The NFS readlink() methods all take a buffer length argument. Use that instead of assuming PAGE_SIZE... We need to return ENAMETOOLONG rather than EIO. --- fs/nfs/nfs2xdr.c | 11 +++++++---- fs/nfs/nfs3xdr.c | 11 +++++++---- fs/nfs/nfs4xdr.c | 11 ++++++----- 3 files changed, 20 insertions(+), 13 deletions(-) diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c index 61f5e81053927..6a324838fa341 100644 --- a/fs/nfs/nfs2xdr.c +++ b/fs/nfs/nfs2xdr.c @@ -511,8 +511,8 @@ static int nfs_xdr_readlinkargs(struct rpc_rqst *req, u32 *p, struct nfs_readlinkargs *args) { struct rpc_auth *auth = req->rq_task->tk_auth; + unsigned int count = args->count - 5; unsigned int replen; - u32 count = args->count - 4; p = xdr_encode_fhandle(p, args->fh); req->rq_slen = xdr_adjust_iovec(req->rq_svec, p); @@ -547,12 +547,15 @@ nfs_xdr_readlinkres(struct rpc_rqst *req, u32 *p, void *dummy) strlen = (u32*)kmap_atomic(rcvbuf->pages[0], KM_USER0); /* Convert length of symlink */ len = ntohl(*strlen); - if (len > rcvbuf->page_len) - len = rcvbuf->page_len; + if (len > rcvbuf->page_len) { + dprintk(KERN_WARNING "nfs: server returned giant symlink!\n"); + kunmap_atomic(strlen, KM_USER0); + return -ENAMETOOLONG; + } *strlen = len; /* NULL terminate the string we got */ string = (char *)(strlen + 1); - string[len] = 0; + string[len] = '\0'; kunmap_atomic(strlen, KM_USER0); return 0; } diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c index 98de0230ced26..56ca3e91f64cc 100644 --- a/fs/nfs/nfs3xdr.c +++ b/fs/nfs/nfs3xdr.c @@ -702,8 +702,8 @@ static int nfs3_xdr_readlinkargs(struct rpc_rqst *req, u32 *p, struct nfs3_readlinkargs *args) { struct rpc_auth *auth = req->rq_task->tk_auth; + unsigned int count = args->count - 5; unsigned int replen; - u32 count = args->count - 4; p = xdr_encode_fhandle(p, args->fh); req->rq_slen = xdr_adjust_iovec(req->rq_svec, p); @@ -742,12 +742,15 @@ nfs3_xdr_readlinkres(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr) strlen = (u32*)kmap_atomic(rcvbuf->pages[0], KM_USER0); /* Convert length of symlink */ len = ntohl(*strlen); - if (len > rcvbuf->page_len) - len = rcvbuf->page_len; + if (len > rcvbuf->page_len) { + dprintk(KERN_WARNING "nfs: server returned giant symlink!\n"); + kunmap_atomic(strlen, KM_USER0); + return -ENAMETOOLONG; + } *strlen = len; /* NULL terminate the string we got */ string = (char *)(strlen + 1); - string[len] = 0; + string[len] = '\0'; kunmap_atomic(strlen, KM_USER0); return 0; } diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index 0e12e772d2552..a2cd1178e3f98 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -947,7 +947,8 @@ static int encode_readdir(struct xdr_stream *xdr, const struct nfs4_readdir_arg static int encode_readlink(struct xdr_stream *xdr, const struct nfs4_readlink *readlink, struct rpc_rqst *req) { struct rpc_auth *auth = req->rq_task->tk_auth; - int replen; + unsigned int count = readlink->count - 5; + unsigned int replen; uint32_t *p; RESERVE_SPACE(4); @@ -958,7 +959,7 @@ static int encode_readlink(struct xdr_stream *xdr, const struct nfs4_readlink *r * + OP_READLINK + status = 7 */ replen = (RPC_REPHDRSIZE + auth->au_rslack + 7) << 2; - xdr_inline_pages(&req->rq_rcv_buf, replen, readlink->pages, 0, readlink->count); + xdr_inline_pages(&req->rq_rcv_buf, replen, readlink->pages, 0, count); return 0; } @@ -2921,10 +2922,10 @@ static int decode_readlink(struct xdr_stream *xdr, struct rpc_rqst *req) */ strlen = (uint32_t *) kmap_atomic(rcvbuf->pages[0], KM_USER0); len = ntohl(*strlen); - if (len > PAGE_CACHE_SIZE - 5) { - printk(KERN_WARNING "nfs: server returned giant symlink!\n"); + if (len > rcvbuf->page_len) { + dprintk(KERN_WARNING "nfs: server returned giant symlink!\n"); kunmap_atomic(strlen, KM_USER0); - return -EIO; + return -ENAMETOOLONG; } *strlen = len; -- 2.53.0