]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
nfsd: Fix sanity check for NFSv4.2 Allocate operations
authorRick Macklem <rmacklem@FreeBSD.org>
Thu, 12 Aug 2021 23:48:28 +0000 (16:48 -0700)
committerRick Macklem <rmacklem@FreeBSD.org>
Thu, 12 Aug 2021 23:48:28 +0000 (16:48 -0700)
commit06afb53bcd7b6a928bc90acb820383302ea8be9e
tree0100e7854ea5d548f492cffd7330763f5bb0a132
parent5ff5d1177bc66f1c2a0a6ee4d0ffa128d32e1dad
nfsd: Fix sanity check for NFSv4.2 Allocate operations

The NFSv4.2 Allocate operation sanity checks the aa_offset
and aa_length arguments.  Since they are assigned to variables
of type off_t (signed) it was possible for them to be negative.
It was also possible for aa_offset+aa_length to exceed OFF_MAX
when stored in lo_end, which is uint64_t.

This patch adds checks for these cases to the sanity check.

Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D31511
sys/fs/nfsserver/nfs_nfsdserv.c