mbox series

[v3,0/6] Fix XDR encoding near page boundaries

Message ID 20241226162853.8940-1-cel@kernel.org (mailing list archive)
Headers show
Series Fix XDR encoding near page boundaries | expand

Message

Chuck Lever Dec. 26, 2024, 4:28 p.m. UTC 
From: Chuck Lever <chuck.lever@oracle.com>

Refresh the patch series to address the longstanding bug pointed out
by J David and Rick Macklem.

I believe we have identified and addressed this issue in all of
the NFSv4 COMPOUND operation encoders on the server side. Only the
GSS integrity and privacy encoders are still vulnerable but "safe
for now". Barring further review comments, this series is code-
complete.

Neil suggests xdr_reserve_space() should not ever be open-coded in
NFSv4 code. That seems difficult to enforce: nfsd4_encode_operation()
is certainly an XDR encode function; it lives in fs/nfsd/nfs4xdr.c,
for instance. So xdr_reserve_space() seems like a reasonable thing
to see in that function. I'm not sure exactly where to draw that
line.

Changes since v2:
- Address same issue in NFSv4 READ/READ_PLUS and fattr4 encoders

Chuck Lever (6):
  NFSD: Encode COMPOUND operation status on page boundaries
  NFSD: Insulate nfsd4_encode_read() from page boundaries in the encode
    buffer
  NFSD: Insulate nfsd4_encode_read_plus() from page boundaries in the
    encode buffer
  NFSD: Insulate nfsd4_encode_read_plus_data() from page boundaries in
    the encode buffer
  NFSD: Insulate nfsd4_encode_fattr4() from page boundaries in the
    encode buffer
  SUNRPC: Document validity guarantees of the pointer returned by
    reserve_space

 fs/nfsd/nfs4xdr.c | 109 ++++++++++++++++++++++++++--------------------
 net/sunrpc/xdr.c  |   3 ++
 2 files changed, 65 insertions(+), 47 deletions(-)