Skip to contentSkip to conversation

nfsd: zero NFSv4 COMPOUND tag padding

PATCH In review Aldo Ariel Panzardo 3 participants 3 messages Sep 15

Subsystems (3)
Stable branch NFS client NFS server
lore
Share & tools
lore

Aldo Ariel Panzardo

author
#0 lore raw

PATCH 1/1 nfsd: zero NFSv4 COMPOUND tag padding

nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space and skips directly to the aligned end of the field. xdr_reserve_space() rounds the reservation up but does not initialize the padding bytes.

A remote client can choose a tag length that is not a multiple of four, causing one to three stale bytes from the response page to be returned in the COMPOUND reply.

Use xdr_encode_opaque_fixed() to copy the tag and clear its XDR padding.

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc [email protected]
Signed-off-by Aldo Ariel Panzardo <[email protected]>
---
 fs/nfsd/nfs4xdr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
fs/nfsd/nfs4xdr.c +1 -2
index e17488a911..9377f42dfd 100644
@@ -6480,8 +6480,7 @@ nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr)
 
 	*p++ = resp->cstate.status;
 	*p++ = htonl(resp->taglen);
-	memcpy(p, resp->tag, resp->taglen);
-	p += XDR_QUADLEN(resp->taglen);
+	p = xdr_encode_opaque_fixed(p, resp->tag, resp->taglen);
 	*p++ = htonl(resp->opcnt);
 
 	nfsd4_sequence_done(resp);
Signature · 1 line
2.43.0
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 22 lines · Aldo Ariel Panzardo

nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space and skips directly to the aligned end of the field. xdr_reserve_space() rounds the reservation up but does not initialize the padding bytes.

A remote client can choose a tag length that is not a multiple of four, causing one to three stale bytes from the response page to be returned in the COMPOUND reply.

Use xdr_encode_opaque_fixed() to copy the tag and clear its XDR padding.

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc [email protected]
Signed-off-by Aldo Ariel Panzardo <[email protected]>
---
 fs/nfsd/nfs4xdr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
fs/nfsd/nfs4xdr.c +0 -0
index e17488a911..9377f42dfd 100644

fs/nfsd/nfs4xdr.c nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr) · line 6486

Quoted 9 lines
fs/nfsd/nfs4xdr.c +1 -2
@@ -6480,8 +6480,7 @@ nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr)
 
 	*p++ = resp->cstate.status;
 	*p++ = htonl(resp->taglen);
-	memcpy(p, resp->tag, resp->taglen);
-	p += XDR_QUADLEN(resp->taglen);
+	p = xdr_encode_opaque_fixed(p, resp->tag, resp->taglen);
 	*p++ = htonl(resp->opcnt);
 
 	nfsd4_sequence_done(resp);
Reviewed-by Jeff Layton <[email protected]>
maintainer
#2 lore raw
In reply to Aldo Ariel Panzardo
Quoted 9 lines · Aldo Ariel Panzardo

nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space and skips directly to the aligned end of the field. xdr_reserve_space() rounds the reservation up but does not initialize the padding bytes.

A remote client can choose a tag length that is not a multiple of four, causing one to three stale bytes from the response page to be returned in the COMPOUND reply.

[...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: zero NFSv4 COMPOUND tag padding

      commit: 28c0a5693a60625fb794943f2755c4bc5643f7c4

--
Chuck Lever