nfsd: Limit end of page list when decoding NFSv4 WRITE
authorChuck Lever <chuck.lever@oracle.com>
Fri, 18 Aug 2017 15:12:19 +0000 (11:12 -0400)
committerJ. Bruce Fields <bfields@redhat.com>
Thu, 24 Aug 2017 22:05:30 +0000 (18:05 -0400)
commitfc788f64f1f3eb31e87d4f53bcf1ab76590d5838
treec376a2d770711851ea97fdc6bf62a867986c0a4b
parenteff793687792d3eed594d147aceef2000fb9ca3d
nfsd: Limit end of page list when decoding NFSv4 WRITE

When processing an NFSv4 WRITE operation, argp->end should never
point past the end of the data in the final page of the page list.
Otherwise, nfsd4_decode_compound can walk into uninitialized memory.

More critical, nfsd4_decode_write is failing to increment argp->pagelen
when it increments argp->pagelist.  This can cause later xdr decoders
to assume more data is available than really is, which can cause server
crashes on malformed requests.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
fs/nfsd/nfs4xdr.c