NFSD: Clamp WRITE offsets
authorChuck Lever <chuck.lever@oracle.com>
Tue, 25 Jan 2022 21:36:22 +0000 (16:36 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Feb 2022 11:56:06 +0000 (12:56 +0100)
commit01c3ae81eef4d4f718bd946c11451c9f12bff68d
treeef5896cc8e445cdeeef9023be72e21e85b938d83
parent8e0ecaf7a7e57b30284d6b3289cc436100fadc48
NFSD: Clamp WRITE offsets

commit 6260d9a56ab352b54891ec66ab0eced57d55abc6 upstream.

Ensure that a client cannot specify a WRITE range that falls in a
byte range outside what the kernel's internal types (such as loff_t,
which is signed) can represent. The kiocb iterators, invoked in
nfsd_vfs_write(), should properly limit write operations to within
the underlying file system's s_maxbytes.

Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/nfsd/nfs3proc.c
fs/nfsd/nfs4proc.c