From: Chuck Lever <chuck.lever@oracle.com>
Date: Thu, 1 Sep 2022 15:10:05 -0400
Subject: [PATCH] NFSD: Protect against send buffer overflow in NFSv2 READDIR
Git-commit: 00b4492686e0497fdb924a9d4c8f6f99377e176c
Patch-mainline: v6.1
References: bsc#1205128 CVE-2022-43945
Restore the previous limit on the @count argument to prevent a
buffer overflow attack.
Fixes: 53b1119a6e50 ("NFSD: Fix READDIR buffer overflow")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Acked-by: NeilBrown <neilb@suse.com>
---
fs/nfsd/nfsproc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -511,8 +511,11 @@ nfsd_proc_readdir(struct svc_rqst *rqstp
SVCFH_fmt(&argp->fh),
argp->count, argp->cookie);
+ count = argp->count;
+ if (count > PAGE_SIZE)
+ count = PAGE_SIZE;
/* Shrink to the client read size */
- count = (argp->count >> 2) - 2;
+ count = (count >> 2) - 2;
/* Make sure we've room for the NULL ptr & eof flag */
count -= 2;