kernel.git/net/sunrpc/xdr.c, branch linux-4.14.y

SUNRPC: Fix READ_PLUS crasher

2022-07-07T15:31:16Z

commit a23dd544debcda4ee4a549ec7de59e85c3c8345c upstream. Looks like there are still cases when "space_left - frag1bytes" can legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains within the current encode buffer. Reported-by: Bruce Fields Reported-by: Zorro Lang Link: https://bugzilla.kernel.org/show_bug.cgi?id=216151 Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()") Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman

SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()

2022-06-14T14:53:58Z

[ Upstream commit 6c254bf3b637dd4ef4f78eb78c7447419c0161d7 ] I found that NFSD's new NFSv3 READDIRPLUS XDR encoder was screwing up right at the end of the page array. xdr_get_next_encode_buffer() does not compute the value of xdr->end correctly: * The check to see if we're on the final available page in xdr->buf needs to account for the space consumed by @nbytes. * The new xdr->end value needs to account for the portion of @nbytes that is to be encoded into the previous buffer. Fixes: 2825a7f90753 ("nfsd4: allow encoding across page boundaries") Signed-off-by: Chuck Lever Reviewed-by: NeilBrown Reviewed-by: J. Bruce Fields Signed-off-by: Sasha Levin

SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()

2020-06-30T19:38:09Z

commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream. @subbuf is an output parameter of xdr_buf_subsegment(). A survey of call sites shows that @subbuf is always uninitialized before xdr_buf_segment() is invoked by callers. There are some execution paths through xdr_buf_subsegment() that do not set all of the fields in @subbuf, leaving some pointer fields containing garbage addresses. Subsequent processing of that buffer then results in a page fault. Signed-off-by: Chuck Lever Cc: Signed-off-by: Anna Schumaker Signed-off-by: Greg Kroah-Hartman

SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer()

2018-11-27T15:10:49Z

[ Upstream commit 025911a5f4e36955498ed50806ad1b02f0f76288 ] There is no need to have the '__be32 *p' variable static since new value always be assigned before use it. Signed-off-by: YueHaibing Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields Signed-off-by: Sasha Levin

sunrpc: correct the computation for page_ptr when truncating

2018-11-21T08:24:14Z

commit 5d7a5bcb67c70cbc904057ef52d3fcfeb24420bb upstream. When truncating the encode buffer, the page_ptr is getting advanced, causing the next page to be skipped while encoding. The page is still included in the response, so the response contains a page of bogus data. We need to adjust the page_ptr backwards to ensure we encode the next page into the correct place. We saw this triggered when concurrent directory modifications caused nfsd4_encode_direct_fattr() to return nfserr_noent, and the resulting call to xdr_truncate_encode() corrupted the READDIR reply. Signed-off-by: Frank Sorenson Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman

sunrpc: Fix xdr_init_decode_pages() documenting comment

2017-04-25T20:12:34Z

Clean up. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker

SUNRPC: Add a helper function xdr_stream_decode_string_dup()

2017-02-21T21:56:16Z

Create a helper function that decodes a xdr string object, allocates a memory buffer and then store it as a NUL terminated string. Signed-off-by: Trond Myklebust Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker

SUNRPC: Fix setting of buffer length in xdr_set_next_buffer()

2016-09-22T21:17:47Z

Use xdr->nwords to tell us how much buffer remains. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker

SUNRPC: Fix corruption of xdr->nwords in xdr_copy_to_scratch

2016-09-22T21:12:31Z

When we copy the first part of the data, we need to ensure that value of xdr->nwords is updated as well. Do so by calling __xdr_inline_decode() Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker

SUNRPC: init xdr_stream for zero iov_len, page_len

2016-05-09T13:05:40Z

An xdr_buf with head[0].iov_len = 0 and page_len = 0 will cause xdr_init_decode() to incorrectly setup the xdr_stream. Specifically, xdr->end is never initialized. Signed-off-by: Benjamin Coddington Signed-off-by: Anna Schumaker