[PATCH 5.4.y] NFSD: Fix ia_size underflow

[PATCH 5.4.y] NFSD: Fix ia_size underflow

[Larry Bassel]

From: Chuck Lever <chuck.lever@oracle.com>

[ Upstream commit e6faac3f58c7c4176b66f63def17a34232a17b0e ]

iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and
NFSv4 both define file size as an unsigned 64-bit type. Thus there
is a range of valid file size values an NFS client can send that is
already larger than Linux can handle.

Currently decode_fattr4() dumps a full u64 value into ia_size. If
that value happens to be larger than S64_MAX, then ia_size
underflows. I'm about to fix up the NFSv3 behavior as well, so let's
catch the underflow in the common code path: nfsd_setattr().

Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
(cherry picked from commit e6faac3f58c7c4176b66f63def17a34232a17b0e)
[Larry: backport to 5.4.y. Minor conflict resolved due to missing commit 2f221d6f7b88
attr: handle idmapped mounts]
Signed-off-by: Larry Bassel <larry.bassel@oracle.com>
---
 fs/nfsd/vfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 6aa968bee0ce..bee4fdf6e239 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -448,6 +448,10 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
 			.ia_size	= iap->ia_size,
 		};
 
+		host_err = -EFBIG;
+		if (iap->ia_size < 0)
+			goto out_unlock;
+
 		host_err = notify_change(dentry, &size_attr, NULL);
 		if (host_err)
 			goto out_unlock;
-- 
2.46.0

Re: [PATCH 5.4.y] NFSD: Fix ia_size underflow

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: e6faac3f58c7c4176b66f63def17a34232a17b0e

WARNING: Author mismatch between patch and upstream commit:
Backport author: Larry Bassel<larry.bassel@oracle.com>
Commit author: Chuck Lever<chuck.lever@oracle.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.14.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Present (exact SHA1)
6.1.y | Present (exact SHA1)
5.15.y | Present (different SHA1: 8e0ecaf7a7e5)
5.10.y | Present (different SHA1: 38d02ba22e43)

Note: The patch differs from the upstream commit:
---
1:  e6faac3f58c7c ! 1:  6dd1d223c9523 NFSD: Fix ia_size underflow
    @@ Metadata
      ## Commit message ##
         NFSD: Fix ia_size underflow
     
    +    [ Upstream commit e6faac3f58c7c4176b66f63def17a34232a17b0e ]
    +
         iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and
         NFSv4 both define file size as an unsigned 64-bit type. Thus there
         is a range of valid file size values an NFS client can send that is
    @@ Commit message
     
         Cc: stable@vger.kernel.org
         Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    +    (cherry picked from commit e6faac3f58c7c4176b66f63def17a34232a17b0e)
    +    [Larry: backport to 5.4.y. Minor conflict resolved due to missing commit 2f221d6f7b88
    +    attr: handle idmapped mounts]
    +    Signed-off-by: Larry Bassel <larry.bassel@oracle.com>
     
      ## fs/nfsd/vfs.c ##
     @@ fs/nfsd/vfs.c: nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
    @@ fs/nfsd/vfs.c: nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct i
     +		if (iap->ia_size < 0)
     +			goto out_unlock;
     +
    - 		host_err = notify_change(&init_user_ns, dentry, &size_attr, NULL);
    + 		host_err = notify_change(dentry, &size_attr, NULL);
      		if (host_err)
      			goto out_unlock;
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.4.y        |  Success    |  Success   |