summaryrefslogtreecommitdiff
path: root/fs/nfsd/nfs3proc.c
diff options
context:
space:
mode:
authorChuck Lever <chuck.lever@oracle.com>2022-01-25 16:36:22 -0500
committerChuck Lever <chuck.lever@oracle.com>2022-02-09 09:24:01 -0500
commit6260d9a56ab352b54891ec66ab0eced57d55abc6 (patch)
tree08f0fa649fbfd2676938db6885fd58a3248bbc9a /fs/nfsd/nfs3proc.c
parenta648fdeb7c0e17177a2280344d015dba3fbe3314 (diff)
NFSD: Clamp WRITE offsets
Ensure that a client cannot specify a WRITE range that falls in a byte range outside what the kernel's internal types (such as loff_t, which is signed) can represent. The kiocb iterators, invoked in nfsd_vfs_write(), should properly limit write operations to within the underlying file system's s_maxbytes. Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'fs/nfsd/nfs3proc.c')
-rw-r--r--fs/nfsd/nfs3proc.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index b5a52528f19f..aca38ed1526e 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -203,6 +203,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp)
(unsigned long long) argp->offset,
argp->stable? " stable" : "");
+ resp->status = nfserr_fbig;
+ if (argp->offset > (u64)OFFSET_MAX ||
+ argp->offset + argp->len > (u64)OFFSET_MAX)
+ return rpc_success;
+
fh_copy(&resp->fh, &argp->fh);
resp->committed = argp->stable;
nvecs = svc_fill_write_vector(rqstp, &argp->payload);