nfsd41: check the size of request
Check in SEQUENCE that the request doesn't exceed maxreq_sz for the given session. Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
		
							parent
							
								
									1b74c25bc1
								
							
						
					
					
						commit
						ae82a8d06f
					
				| @ -1762,6 +1762,14 @@ static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_sess | ||||
| 	return args->opcnt > session->se_fchannel.maxops; | ||||
| } | ||||
| 
 | ||||
| static bool nfsd4_request_too_big(struct svc_rqst *rqstp, | ||||
| 				  struct nfsd4_session *session) | ||||
| { | ||||
| 	struct xdr_buf *xb = &rqstp->rq_arg; | ||||
| 
 | ||||
| 	return xb->len > session->se_fchannel.maxreq_sz; | ||||
| } | ||||
| 
 | ||||
| __be32 | ||||
| nfsd4_sequence(struct svc_rqst *rqstp, | ||||
| 	       struct nfsd4_compound_state *cstate, | ||||
| @ -1794,6 +1802,10 @@ nfsd4_sequence(struct svc_rqst *rqstp, | ||||
| 	if (nfsd4_session_too_many_ops(rqstp, session)) | ||||
| 		goto out; | ||||
| 
 | ||||
| 	status = nfserr_req_too_big; | ||||
| 	if (nfsd4_request_too_big(rqstp, session)) | ||||
| 		goto out; | ||||
| 
 | ||||
| 	status = nfserr_badslot; | ||||
| 	if (seq->slotid >= session->se_fchannel.maxreqs) | ||||
| 		goto out; | ||||
|  | ||||
		Loading…
	
		Reference in New Issue
	
	Block a user