diff options
| author | Rick Macklem <rmacklem@FreeBSD.org> | 2021-11-26 23:42:32 +0000 |
|---|---|---|
| committer | Rick Macklem <rmacklem@FreeBSD.org> | 2021-12-10 01:04:17 +0000 |
| commit | 0f2244008573e4a3d8dd4131972eefbf1bec681e (patch) | |
| tree | 59430bf8a6c2f9438fc56d59320f0162bb3186de | |
| parent | 911a1cc05e7618a90438178fae28c02e77cda64f (diff) | |
nfsd: Add checks for layout errors in LayoutReturn
For a LayoutReturn when using the Flexible File Layout,
error reports may be provided in the request.
Sanity check the size of these error reports and
check that they exist before calling nfsrv_flexlayouterr().
PR: 260012
(cherry picked from commit bdd57cbb1bdafcf2ebffa73c52f0fffc9410ea7b)
| -rw-r--r-- | sys/fs/nfsserver/nfs_nfsdserv.c | 6 | ||||
| -rw-r--r-- | sys/fs/nfsserver/nfs_nfsdstate.c | 2 |
2 files changed, 7 insertions, 1 deletions
diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c index cd10b735ee34..a7f7debc11a6 100644 --- a/sys/fs/nfsserver/nfs_nfsdserv.c +++ b/sys/fs/nfsserver/nfs_nfsdserv.c @@ -4708,6 +4708,12 @@ nfsrvd_layoutreturn(struct nfsrv_descript *nd, __unused int isdgram, } maxcnt = fxdr_unsigned(int, *tl); + /* + * There is no fixed upper bound defined in the RFCs, + * but 128Kbytes should be more than sufficient. + */ + if (maxcnt < 0 || maxcnt > 131072) + maxcnt = 0; if (maxcnt > 0) { layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK); error = nfsrv_mtostr(nd, (char *)layp, maxcnt); diff --git a/sys/fs/nfsserver/nfs_nfsdstate.c b/sys/fs/nfsserver/nfs_nfsdstate.c index 3423eddc7366..d9235ab783c6 100644 --- a/sys/fs/nfsserver/nfs_nfsdstate.c +++ b/sys/fs/nfsserver/nfs_nfsdstate.c @@ -7264,7 +7264,7 @@ nfsrv_layoutreturn(struct nfsrv_descript *nd, vnode_t vp, } NFSDRECALLUNLOCK(); } - if (layouttype == NFSLAYOUT_FLEXFILE) + if (layouttype == NFSLAYOUT_FLEXFILE && layp != NULL) nfsrv_flexlayouterr(nd, layp, maxcnt, p); } else if (kind == NFSV4LAYOUTRET_FSID) nfsrv_freelayouts(&nd->nd_clientid, |