Re: NFS & long symlinks = stack overflow

[Trond Myklebust <trond.myklebust@fys.uio.no>]

On Sat, 2004-05-15 at 10:53, viro@parcelfarce.linux.theplanet.co.uk
wrote:

> Lovely...  How are other clients dealing with that?  Put a reasonable
> limit on the size and return an error if READLINK brings more than that?

Yes. The following patch (backported from the NFSv4 code) should do the
right thing...

Cheers,
  Trond

--- linux-2.6.6-rc3/fs/nfs/nfs3xdr.c.orig	2004-05-09 01:31:17.000000000 -0400
+++ linux-2.6.6-rc3/fs/nfs/nfs3xdr.c	2004-05-15 13:35:06.000000000 -0400
@@ -742,8 +742,11 @@ nfs3_xdr_readlinkres(struct rpc_rqst *re
 	strlen = (u32*)kmap_atomic(rcvbuf->pages[0], KM_USER0);
 	/* Convert length of symlink */
 	len = ntohl(*strlen);
-	if (len > rcvbuf->page_len)
-		len = rcvbuf->page_len;
+	if (len > PAGE_CACHE_SIZE - 5) {
+		printk(KERN_WARNING "nfs: server returned giant symlink!\n");
+		kunmap_atomic(strlen, KM_USER0);
+		return -EIO;
+	}
 	*strlen = len;
 	/* NULL terminate the string we got */
 	string = (char *)(strlen + 1);