J. Bruce Fields 82a0d8aabe nfsd: check for oversized NFSv2/v3 arguments ... commit e6838a29ecb484c97e4efef9429643b9851fba6e upstream. A client can append random data to the end of an NFSv2 or NFSv3 RPC call without our complaining; we'll just stop parsing at the end of the expected data and ignore the rest. Encoded arguments and replies are stored together in an array of pages, and if a call is too large it could leave inadequate space for the reply. This is normally OK because NFS RPC's typically have either short arguments and long replies (like READ) or long arguments and short replies (like WRITE). But a client that sends an incorrectly long reply can violate those assumptions. This was observed to cause crashes. Also, several operations increment rq_next_page in the decode routine before checking the argument size, which can leave rq_next_page pointing well past the end of the page array, causing trouble later in svc_free_pages. So, following a suggestion from Neil Brown, add a central check to enforce our expectation that no NFSv2/v3 call has both a large call and a large reply. As followup we may also want to rewrite the encoding routines to check more carefully that they aren't running off the end of the page array. We may also consider rejecting calls that have any extra garbage appended. That would be safer, and within our rights by spec, but given the age of our server and the NFS protocol, and the fact that we've never enforced this before, we may need to balance that against the possibility of breaking some oddball client. Reported-by: Tuomas Haanpää <thaan@synopsys.com> Reported-by: Ari Kauppi <ari@synopsys.com> Reviewed-by: NeilBrown <neilb@suse.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-05-02 21:19:56 -07:00
..
9p	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
adfs
affs	affs: fix remount failure when there are no options changed	2016-06-07 18:14:32 -07:00
afs
autofs4	autofs: use dentry flags to block walks during expire	2016-09-30 10:18:37 +02:00
befs
bfs
btrfs	btrfs: fix error handling when run_delayed_extent_op fails	2017-01-19 20:17:21 +01:00
cachefiles	FS-Cache: Add missing initialization of ret in cachefiles_write_page()	2015-11-16 20:38:43 -05:00
ceph	ceph: remove req from unsafe list when unregistering it	2017-03-15 09:57:13 +08:00
cifs	CIFS: remove bad_network_name flag	2017-04-27 09:09:32 +02:00
coda
configfs	configfs: allow dynamic group creation	2015-11-20 16:17:32 -08:00
cramfs
debugfs	debugfs: Make automount point inodes permanently empty	2016-05-04 14:48:41 -07:00
devpts	devpts: clean up interface to pty drivers	2016-08-16 09:30:49 +02:00
dlm	dlm: free workqueues after the connections	2016-10-22 12:26:56 +02:00
ecryptfs	ecryptfs: fix handling of directory opening	2016-09-15 08:27:47 +02:00
efivarfs	efi: Make efivarfs entries immutable by default	2016-03-03 15:07:09 -08:00
efs
exofs	osd fs: __r4w_get_page rely on PageUptodate for uptodate	2015-12-12 10:15:34 -08:00
exportfs
ext2	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
ext4	ext4: check if in-inode xattr is corrupted in ext4_expand_extra_isize_ea()	2017-05-02 21:19:48 -07:00
f2fs	f2fs: do more integrity verification for superblock	2017-05-02 21:19:47 -07:00
fat	fat: fix using uninitialized fields of fat_inode/fsinfo_inode	2017-03-15 09:57:15 +08:00
freevxfs
fscache	FS-Cache: Handle a write to the page immediately beyond the EOF marker	2015-11-11 02:11:02 -05:00
fuse	fuse: add missing FR_FORCE	2017-03-12 06:37:28 +01:00
gfs2	gfs2: avoid uninitialized variable warning	2017-04-30 05:49:28 +02:00
hfs
hfsplus	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
hostfs	hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()	2016-09-30 10:18:39 +02:00
hpfs	hpfs: implement the show_options method	2016-06-01 12:15:54 -07:00
hugetlbfs	fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list()	2016-02-25 12:01:22 -08:00
isofs	isofs: Do not return EACCES for unknown filesystems	2016-10-28 03:01:34 -04:00
jbd2	jbd2: don't leak modified metadata buffers on an aborted journal	2017-03-12 06:37:26 +01:00
jffs2	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
jfs	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
kernfs	kernfs: don't depend on d_find_any_alias() when generating notifications	2016-09-24 10:07:36 +02:00
lockd	Mainly smaller bugfixes and cleanup. We're still finding some bugs from	2015-11-11 20:11:28 -08:00
logfs	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
minix
ncpfs	ncpfs: fix a braino in OOM handling in ncp_fill_cache()	2016-03-16 08:42:59 -07:00
nfs	NFSv4: fix getacl ERANGE for some ACL buffer sizes	2017-03-12 06:37:30 +01:00
nfs_common
nfsd	nfsd: check for oversized NFSv2/v3 arguments	2017-05-02 21:19:56 -07:00
nilfs2	fs/nilfs2: fix potential underflow in call to crc32_le	2016-08-10 11:49:25 +02:00
nls
notify	fanotify: fix list corruption in fanotify_get_response()	2016-09-30 10:18:37 +02:00
ntfs	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
ocfs2	ocfs2: fix crash caused by stale lvb with fsdlm plugin	2017-01-19 20:17:19 +01:00
omfs
openpromfs
overlayfs	ovl: fsync after copy-up	2016-11-10 16:36:34 +01:00
proc	thp: fix MADV_DONTNEED vs clear soft dirty race	2017-04-21 09:30:04 +02:00
pstore	pstore/ram: Use memcpy_fromio() to save old buffer	2016-10-28 03:01:27 -04:00
qnx4
qnx6
quota	quota: Fix possible GPF due to uninitialised pointers	2016-04-12 09:08:56 -07:00
ramfs	mm, fs: obey gfp_mapping for add_to_page_cache()	2015-10-16 11:42:28 -07:00
reiserfs	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
romfs
squashfs	squashfs: xattr simplifications	2015-11-13 20:34:33 -05:00
sysfs	sysfs: be careful of error returns from ops->show()	2017-04-12 12:38:33 +02:00
sysv	fix sysvfs symlinks	2015-11-23 21:11:08 -05:00
tracefs	tracefs: Fix refcount imbalance in start_creating()	2015-11-04 22:13:45 -05:00
ubifs	ubifs: Fix journal replay wrt. xattr nodes	2017-01-26 08:23:48 +01:00
udf	udf: Check output buffer length when converting name to CS0	2016-02-25 12:01:18 -08:00
ufs
xfs	xfs: clear _XBF_PAGES from buffers when readahead page	2017-03-30 09:35:19 +02:00
aio.c	aio: mark AIO pseudo-fs noexec	2016-10-07 15:23:47 +02:00
anon_inodes.c
attr.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	Merge branch 'for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-11-11 09:45:24 -08:00
binfmt_elf_fdpic.c	libnvdimm for 4.4:	2015-11-10 12:07:22 -08:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	block: protect iterate_bdevs() against concurrent close	2017-01-09 08:07:47 +01:00
buffer.c	vfs: remove unused wrapper block_page_mkwrite()	2015-11-11 02:19:33 -05:00
char_dev.c
compat.c
compat_binfmt_elf.c
compat_ioctl.c	i2c-dev: Fix typo in ioctl name reference	2015-10-23 23:26:43 +02:00
coredump.c	coredump: fix unfreezable coredumping task	2016-11-18 10:48:34 +01:00
dax.c	dax: disable pmd mappings	2015-11-16 23:54:45 -08:00
dcache.c	mnt: Protect the mountpoint hashtable with mount_lock	2017-01-19 20:17:21 +01:00
dcookies.c
direct-io.c	block: fix use-after-free in dio_bio_complete	2016-03-03 15:07:28 -08:00
drop_caches.c
eventfd.c
eventpoll.c
exec.c	exec: Ensure mm->user_ns contains the execed files	2017-01-06 11:16:14 +01:00
fcntl.c
fhandle.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-04-12 09:08:58 -07:00
file.c	vfs: clear remainder of 'full_fds_bits' in dup_fd()	2015-11-05 23:05:32 -08:00
file_table.c
filesystems.c
fs-writeback.c	writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode	2016-04-12 09:09:04 -07:00
fs_pin.c
fs_struct.c
inode.c	vfs: fix deadlock in file_remove_privs() on overlayfs	2016-08-10 11:49:30 +02:00
internal.h
ioctl.c
Kconfig	dax: disable pmd mappings	2015-11-16 23:54:45 -08:00
Kconfig.binfmt
libfs.c
locks.c	locks: use file_inode()	2016-08-10 11:49:27 +02:00
Makefile	ext4: promote ext4 over ext2 in the default probe order	2015-10-15 10:33:21 -04:00
mbcache.c
mount.h	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
mpage.c	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
namei.c	fs: Check for invalid i_uid in may_follow_link()	2016-09-15 08:27:49 +02:00
namespace.c	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
no-block.c
nsfs.c
open.c	vfs: add vfs_select_inode() helper	2016-05-18 17:06:48 -07:00
pipe.c	pipe: limit the per-user amount of pages allocated in pipes	2016-06-07 18:14:35 -07:00
pnode.c	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
pnode.h	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
posix_acl.c	tmpfs: clear S_ISGID when setting posix ACLs	2017-01-26 08:23:47 +01:00
proc_namespace.c	vfs: show_vfsstat: do not ignore errors from show_devname method	2016-04-12 09:08:55 -07:00
read_write.c
readdir.c
select.c
seq_file.c	fs/seq_file: fix out-of-bounds read	2016-09-07 08:32:43 +02:00
signalfd.c
splice.c	vfs: fix uninitialized flags in splice_to_pipe()	2017-02-23 17:43:09 +01:00
stack.c
stat.c	fs/stat.c: remove unnecessary new_valid_dev() check	2015-11-09 15:11:24 -08:00
statfs.c
super.c	fs/super.c: fix race between freeze_super() and thaw_super()	2016-10-28 03:01:32 -04:00
sync.c	fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback	2015-11-06 17:50:42 -08:00
timerfd.c	timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper	2016-02-25 12:01:25 -08:00
userfaultfd.c	userfaultfd: don't block on the last VM updates at exit time	2016-03-16 08:43:01 -07:00
utimes.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
xattr.c	9p: xattr simplifications	2015-11-13 20:34:33 -05:00