[PATCH] 2.5.59 knfsd: bounds checking for NFSv3 readdirplus

[Ted Phelps]

For an NFSv3 readdirplus request, knfsd assumes that the outgoing
buffer will be less than a page in length but never checks to see if
this is true (readdir for both NFSv2 and NFSv3 do).  This can lead to
random pages getting trashed and failing NFS requests.

The patch below adds this check in a way which is consistent with the
way the readdir functions do.

Thanks,
-Ted

---8<---

diff -Naur linux-2.5.58-orig/fs/nfsd/nfs3xdr.c linux-2.5.58/fs/nfsd/nfs3xdr.c
--- linux-2.5.58-orig/fs/nfsd/nfs3xdr.c 2003-01-10 09:41:52.000000000 +0000
+++ linux-2.5.58/fs/nfsd/nfs3xdr.c      2003-01-14 19:57:03.000000000 +0000
@@ -578,6 +578,9 @@
        args->dircount = ntohl(*p++);
        args->count    = ntohl(*p++);
 
+       if (args->count > PAGE_SIZE)
+               args->count = PAGE_SIZE;
+
        svc_take_page(rqstp);
        args->buffer = page_address(rqstp->rq_respages[rqstp->rq_resused-1]);