svn commit: r340854 - stable/11/sys/fs/nfsserver

[Ed Maste]

Author: emaste
Date: Fri Nov 23 20:41:54 2018
New Revision: 340854
URL: https://svnweb.freebsd.org/changeset/base/340854

Log:
  MFC r340663 (rmacklem):
  
  Improve sanity checking for the dircount hint argument to
  NFSv3's ReaddirPlus and NFSv4's Readdir operations. The code
  checked for a zero argument, but did not check for a very large value.
  This patch clips dircount at the server's maximum data size.

Modified:
  stable/11/sys/fs/nfsserver/nfs_nfsdport.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/fs/nfsserver/nfs_nfsdport.c
==============================================================================
--- stable/11/sys/fs/nfsserver/nfs_nfsdport.c	Fri Nov 23 20:39:37 2018	(r340853)
+++ stable/11/sys/fs/nfsserver/nfs_nfsdport.c	Fri Nov 23 20:41:54 2018	(r340854)
@@ -1858,9 +1858,15 @@ nfsrvd_readdirplus(struct nfsrv_descript *nd, int isdg
 	 * cookie) should be in the reply. At least one client "hints" 0,
 	 * so I set it to cnt for that case. I also round it up to the
 	 * next multiple of DIRBLKSIZ.
+	 * Since the size of a Readdirplus directory entry reply will always
+	 * be greater than a directory entry returned by VOP_READDIR(), it
+	 * does not make sense to read more than NFS_SRVMAXDATA() via
+	 * VOP_READDIR().
 	 */
 	if (siz <= 0)
 		siz = cnt;
+	else if (siz > NFS_SRVMAXDATA(nd))
+		siz = NFS_SRVMAXDATA(nd);
 	siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
 
 	if (nd->nd_flag & ND_NFSV4) {