From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ua2-f12.google.com (mail-ua2-f12.google.com [74.125.226.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8726C3F9F25 for ; Tue, 15 Sep 2026 16:00:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.226.204 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789488040; cv=none; b=uRZSmtAcwAUMLT3dX6rOonIS7Hi+zyeRC/udSf8IQK3gwzhdZic9a8W0sANsnq65YemgA3QqU41Q5ZcBlDI/thh7CkIAAlJ8YCTNaAdR7uSqTFiR6T6lD8vMzos8bQGSBJgKhNJ3lI/ACPzqJZeROMHCT1p7QUJZ1SViUmSCOnw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789488040; c=relaxed/simple; bh=yfFk5AxqlgLH6I0x387ApOK8n1uXyoBrfJ8SxXsFVWA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PhjwSo1+C5qZReeVMkK/raDNuMUzxgW0h6MtU22WOZOf4TbMvTmOY4Nx3wTGHTt8t5rn6pgsEm0B6KMp8MY7bFlfwjWwOWO7JDhwl3N6Tonh3I5ayywFohreU0tPv3YkRaX5bJsSHiBFZYftLBoQUhT1E+xoGzPbwqcaY3AtkcI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=V778B1OD; arc=none smtp.client-ip=74.125.226.204 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="V778B1OD" Received: by mail-ua2-f12.google.com with SMTP id a1e0cc1a2514c-97e7c7b4ed2so276703241.2 for ; Tue, 15 Sep 2026 09:00:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789488035; x=1790092835; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=GUDKgi5BjwUlGqTDW5BhogeZ2whULHpHZjtGCCfq9RU=; b=V778B1ODwI61E6aMAqmTiLs8Ib1DHBkTN+zCMxc2VH0ukbB8PxBIMjF6I5UX3Hv8iP +T3mMtZO/6Su/iXOaAGRYor7RhusIWSNFgCm8jRnYJ+qE0O0UWpCfMVOHNwxj5VBdt/0 sQxyQdfLJVsXwD3wGVxb7XalIjMwmO29npEmmwkh8TGfbQyFSs8+V4b/9L6UmdLLgGLu EP4R9pwGEe+vk/cL04CSNkBwWDxETr/cS0bOMt1Tql23kTOZ8M7iC5rQFQuUP45+Fb4H IxYwFvZJcDsUnin/x8uuv2O7C1djgMsI/sRaNwsazQ5lvRiKIKgG25C7vhNy8yUg3pzH dutQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789488035; x=1790092835; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GUDKgi5BjwUlGqTDW5BhogeZ2whULHpHZjtGCCfq9RU=; b=qenClr2fAX11s8YOR/iUenKzxPhFC27ODhGU4Q/dpCdNkN9dIRwtdVBhizxK8wzxsw pc7K+g1TuKXFcDRsBJT7ntj6w4hR0M4++0r1xch64aq20e8NhC1MunUJjsrTTNbVJ3yI OmuLp18a0ViRCVrV22GYXdcOwQBpe7KrsIQmP+VsfEVj9M6ntYC+fisotPyAQKR92nUa VDLWLTFZCGgfl3hkGBH0uN4OVeREoT5cqKfjWPoRL+h4Rs7HpFCcQFKywAcEeNQakybh mDd0q+Wrr1ZSHg+RafPUx9VUMHsFgGmjL5VteyiAwrv+glFetx+ZJb3jtHfQrDOkedNq MNrQ== X-Forwarded-Encrypted: i=1; AKwUvBy/YzrPHG5jMUNu/lDWt003HLUyAXRpSf3Zr5Y3wxpoR8+AVsIU0Dz5w4xi3zAlbaHKCRUHjPV38YTBYzc=@vger.kernel.org X-Gm-Message-State: AFuF++nJBsRQOdgQjblxGU0DAwZ4Z0w0PTLpy8000O4AZFP3zcM1jMMh fiyKONxjEGb7dRInEzPEUuYFjCq5GxTlAVZ/DKYu26lfKam5NTq9Pf92 X-Gm-Gg: AYBFou0PvMia4ALjGPmO09d0BilslYoe4UH6M6zOS9oVaD/VWyhXjvRf33EI5mrdsAA bW4f4mTOBWXw+wd2eNRMDb5GA+HrbrGAgOvFHtOPQ9hE5x7hav80D+F0bVtLC1gFah0D+BfHa42 MTcqAaW+GcJ08CrT4f5cR50Evd+aYLYiQP4tMlo222sTaXL+pEiUHCBszTj2QguGeilWKN1kX2J Glx5Mh7j/VL5oRGxlH7DlosKWlsdSQ6MggJHyjDo0u48ye0pk5cSTAcoKbO0zlb61OVvy+ibz5t dUdImfEWbmFGsdHvio3ja1+prgX2HTNa7vvzJ11tZh9mE7Yjsb/xoWojDFxIhurGOzCTu7er40t 94OUwGuxEuVdZ9tA8CXPY3XP9C615FlIFczBmAvlagTUFdVUxgmxmme6G8pOY3PdMFPrkYTdWb2 V9eulgxcGJIryAYviXhcDTfGq0wvv1+yAzgYzoV+KO1PvX5A3/+Fd3SakudzZJKBYgBqUZZ6CkB HgF X-Received: by 2002:a05:6122:488c:b0:5c7:d204:db7b with SMTP id 71dfb90a1353d-5c993c0c81dmr3441065e0c.3.1789488035334; Tue, 15 Sep 2026 09:00:35 -0700 (PDT) Received: from beelink.. ([187.13.206.89]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-982ba1789b8sm14883192241.13.2026.09.15.09.00.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 15 Sep 2026 09:00:35 -0700 (PDT) From: Aldo Ariel Panzardo To: Chuck Lever , Jeff Layton Cc: linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Aldo Ariel Panzardo Subject: [PATCH] NFSD: copy SETXATTR data from all XDR buffer segments Date: Tue, 15 Sep 2026 13:00:22 -0300 Message-ID: <20260915160022.3105295-1-qwe.aldo@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit nfsd4_vbuf_from_vector() manually copies the head followed by whole pages starting at offset zero. This assumes that all remaining data starts at the beginning of the page array and that no data is stored in the tail. However, nfsd4_decode_setxattr() passes an xdr_buf returned by xdr_stream_subsegment(). Such a sub-buffer can have a nonzero page_base and can span its page and tail segments. Ignoring that layout can copy the wrong bytes into the value passed to vfs_setxattr(). Use read_bytes_from_xdr_buf(), which observes the complete xdr_buf layout. Fixes: c1346a1216ab ("NFSD: Replace the internals of the READ_BUF() macro") Cc: stable@vger.kernel.org Signed-off-by: Aldo Ariel Panzardo --- fs/nfsd/nfs4xdr.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index e17488a911..0f9f926cbd 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -2288,10 +2288,8 @@ static __be32 nfsd4_vbuf_from_vector(struct nfsd4_compoundargs *argp, struct xdr_buf *xdr, char **bufp, size_t buflen) { - struct page **pages = xdr->pages; struct kvec *head = xdr->head; - char *tmp, *dp; - u32 len; + char *tmp; if (buflen <= head->iov_len) { /* @@ -2306,19 +2304,8 @@ nfsd4_vbuf_from_vector(struct nfsd4_compoundargs *argp, struct xdr_buf *xdr, if (tmp == NULL) return nfserr_jukebox; - dp = tmp; - memcpy(dp, head->iov_base, head->iov_len); - buflen -= head->iov_len; - dp += head->iov_len; - - while (buflen > 0) { - len = min_t(u32, buflen, PAGE_SIZE); - memcpy(dp, page_address(*pages), len); - - buflen -= len; - dp += len; - pages++; - } + if (read_bytes_from_xdr_buf(xdr, 0, tmp, buflen)) + return nfserr_bad_xdr; *bufp = tmp; return 0; -- 2.43.0