svn commit: r340663 - head/sys/fs/nfsserver

[Rick Macklem]

Author: rmacklem
Date: Tue Nov 20 01:59:57 2018
New Revision: 340663
URL: https://svnweb.freebsd.org/changeset/base/340663

Log:
  Improve sanity checking for the dircount hint argument to
  NFSv3's ReaddirPlus and NFSv4's Readdir operations. The code
  checked for a zero argument, but did not check for a very large value.
  This patch clips dircount at the server's maximum data size.
  
  MFC after:	1 week

Modified:
  head/sys/fs/nfsserver/nfs_nfsdport.c

Modified: head/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- head/sys/fs/nfsserver/nfs_nfsdport.c	Tue Nov 20 01:56:34 2018	(r340662)
+++ head/sys/fs/nfsserver/nfs_nfsdport.c	Tue Nov 20 01:59:57 2018	(r340663)
@@ -2107,9 +2107,15 @@ nfsrvd_readdirplus(struct nfsrv_descript *nd, int isdg
 	 * cookie) should be in the reply. At least one client "hints" 0,
 	 * so I set it to cnt for that case. I also round it up to the
 	 * next multiple of DIRBLKSIZ.
+	 * Since the size of a Readdirplus directory entry reply will always
+	 * be greater than a directory entry returned by VOP_READDIR(), it
+	 * does not make sense to read more than NFS_SRVMAXDATA() via
+	 * VOP_READDIR().
 	 */
 	if (siz <= 0)
 		siz = cnt;
+	else if (siz > NFS_SRVMAXDATA(nd))
+		siz = NFS_SRVMAXDATA(nd);
 	siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
 
 	if (nd->nd_flag & ND_NFSV4) {