]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
NFSD: Insulate nfsd4_encode_fattr4() from page boundaries in the encode buffer
authorChuck Lever <chuck.lever@oracle.com>
Tue, 31 Dec 2024 00:28:56 +0000 (19:28 -0500)
committerChuck Lever <chuck.lever@oracle.com>
Sat, 11 Jan 2025 04:43:25 +0000 (23:43 -0500)
Commit ab04de60ae1c ("NFSD: Optimize nfsd4_encode_fattr()") replaced
the use of write_bytes_to_xdr_buf() because it's expensive and the
data items to be encoded are already properly aligned.

However, there's no guarantee that the pointer returned from
xdr_reserve_space() will still point to the correct reserved space
in the encode buffer after one or more intervening calls to
xdr_reserve_space(). It just happens to work with the current
implementation of xdr_reserve_space().

This commit effectively reverts the optimization.

Reviewed-by: NeilBrown <neilb@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
fs/nfsd/nfs4xdr.c

index ae4c6c0060bfd9aaf779111724b3c8d3d43840ee..8d373d2edff147b89a6fbf0186c5b3d444492d21 100644 (file)
@@ -3507,8 +3507,8 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
        struct nfsd4_fattr_args args;
        struct svc_fh *tempfh = NULL;
        int starting_len = xdr->buf->len;
-       __be32 *attrlen_p, status;
-       int attrlen_offset;
+       unsigned int attrlen_offset;
+       __be32 attrlen, status;
        u32 attrmask[3];
        int err;
        struct nfsd4_compoundres *resp = rqstp->rq_resp;
@@ -3629,8 +3629,7 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
 
        /* attr_vals */
        attrlen_offset = xdr->buf->len;
-       attrlen_p = xdr_reserve_space(xdr, XDR_UNIT);
-       if (!attrlen_p)
+       if (unlikely(!xdr_reserve_space(xdr, XDR_UNIT)))
                goto out_resource;
        bitmap_from_arr32(attr_bitmap, attrmask,
                          ARRAY_SIZE(nfsd4_enc_fattr4_encode_ops));
@@ -3640,7 +3639,8 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,
                if (status != nfs_ok)
                        goto out;
        }
-       *attrlen_p = cpu_to_be32(xdr->buf->len - attrlen_offset - XDR_UNIT);
+       attrlen = cpu_to_be32(xdr->buf->len - attrlen_offset - XDR_UNIT);
+       write_bytes_to_xdr_buf(xdr->buf, attrlen_offset, &attrlen, XDR_UNIT);
        status = nfs_ok;
 
 out: