diff options
| author |   Chuck Lever <chuck.lever@oracle.com> | 2026-02-24 12:10:34 -0500 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2026-03-29 21:25:09 -0400 |
| commit | 116b6b7acdd82605ed530232cd7509d1b5282f5c (patch) | |
| tree | fafed6684763a9e678f63c437bbf50b3af1178aa /samples/kobject/ssh:/git@git.zx2c4.com/git:/git.zx2c4.com | |
| parent | nfsd: convert global state_lock to per-net deleg_lock (diff) | |
nfsd: use dynamic allocation for oversized NFSv4.0 replay cache
Commit 1e8e9913672a ("nfsd: fix heap overflow in NFSv4.0 LOCK
replay cache") capped the replay cache copy at NFSD4_REPLAY_ISIZE
to prevent a heap overflow, but set rp_buflen to zero when the
encoded response exceeded the inline buffer. A retransmitted LOCK
reaching the replay path then produced only a status code with no
operation body, resulting in a malformed XDR response.
When the encoded response exceeds the 112-byte inline rp_ibuf, a
buffer is kmalloc'd to hold it. If the allocation fails, rp_buflen
remains zero, preserving the behavior from the capped-copy fix.
The buffer is freed when the stateowner is released or when a
subsequent operation's response fits in the inline buffer.
Fixes: 1e8e9913672a ("nfsd: fix heap overflow in NFSv4.0 LOCK replay cache")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'samples/kobject/ssh:/git@git.zx2c4.com/git:/git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions