svn commit: r340851 - stable/12/sys/fs/nfsserver

[Ed Maste]

Author: emaste
Date: Fri Nov 23 20:32:41 2018
New Revision: 340851
URL: https://svnweb.freebsd.org/changeset/base/340851

Log:
  MFC r340663 (rmacklem):
  
  Improve sanity checking for the dircount hint argument to
  NFSv3's ReaddirPlus and NFSv4's Readdir operations. The code
  checked for a zero argument, but did not check for a very large value.
  This patch clips dircount at the server's maximum data size.

Modified:
  stable/12/sys/fs/nfsserver/nfs_nfsdport.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- stable/12/sys/fs/nfsserver/nfs_nfsdport.c	Fri Nov 23 20:31:27 2018	(r340850)
+++ stable/12/sys/fs/nfsserver/nfs_nfsdport.c	Fri Nov 23 20:32:41 2018	(r340851)
@@ -2107,9 +2107,15 @@ nfsrvd_readdirplus(struct nfsrv_descript *nd, int isdg
 	 * cookie) should be in the reply. At least one client "hints" 0,
 	 * so I set it to cnt for that case. I also round it up to the
 	 * next multiple of DIRBLKSIZ.
+	 * Since the size of a Readdirplus directory entry reply will always
+	 * be greater than a directory entry returned by VOP_READDIR(), it
+	 * does not make sense to read more than NFS_SRVMAXDATA() via
+	 * VOP_READDIR().
 	 */
 	if (siz <= 0)
 		siz = cnt;
+	else if (siz > NFS_SRVMAXDATA(nd))
+		siz = NFS_SRVMAXDATA(nd);
 	siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
 
 	if (nd->nd_flag & ND_NFSV4) {