diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2014-12-22 16:14:51 -0500 |
|---|---|---|
| committer | Luis Henriques <luis.henriques@canonical.com> | 2015-01-16 14:34:29 +0000 |
| commit | 520245221c103eb0589834d5afbc6d377154b842 (patch) | |
| tree | 5a77e79ee73f9dceefbeba2d6f0124e9f50eb325 /include | |
| parent | 948f7d7b964ff9019fbb2b477e16a0a401f83dad (diff) | |
rpc: fix xdr_truncate_encode to handle buffer ending on page boundary
commit 49a068f82a1d30eb585d7804b05948376be6cf9a upstream.
A struct xdr_stream at a page boundary might point to the end of one
page or the beginning of the next, but xdr_truncate_encode isn't
prepared to handle the former.
This can cause corruption of NFSv4 READDIR replies in the case that a
readdir entry that would have exceeded the client's dircount/maxcount
limit would have ended exactly on a 4k page boundary. You're more
likely to hit this case on large directories.
Other xdr_truncate_encode callers are probably also affected.
Reported-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
Tested-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
Fixes: 3e19ce762b53 "rpc: xdr_truncate_encode"
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions