diff options
| author | J. Bruce Fields | 2014-12-22 22:14:51 +0100 |
|---|---|---|
| committer | J. Bruce Fields | 2015-01-07 20:03:58 +0100 |
| commit | 49a068f82a1d30eb585d7804b05948376be6cf9a (patch) | |
| tree | 670d3bc2de3e9faec18f6fbc36f0a997f99a0992 /fs | |
| parent | nfsd: fix fi_delegees leak when fi_had_conflict returns true (diff) | |
| download | kernel-qcow2-linux-49a068f82a1d30eb585d7804b05948376be6cf9a.tar.gz kernel-qcow2-linux-49a068f82a1d30eb585d7804b05948376be6cf9a.tar.xz kernel-qcow2-linux-49a068f82a1d30eb585d7804b05948376be6cf9a.zip | |
rpc: fix xdr_truncate_encode to handle buffer ending on page boundary
A struct xdr_stream at a page boundary might point to the end of one
page or the beginning of the next, but xdr_truncate_encode isn't
prepared to handle the former.
This can cause corruption of NFSv4 READDIR replies in the case that a
readdir entry that would have exceeded the client's dircount/maxcount
limit would have ended exactly on a 4k page boundary. You're more
likely to hit this case on large directories.
Other xdr_truncate_encode callers are probably also affected.
Reported-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
Tested-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
Fixes: 3e19ce762b53 "rpc: xdr_truncate_encode"
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions