Skip to content

[shreeya_ciqlts9_2] NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() #669

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

[shreeya_ciqlts9_2] NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() #669

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2cad47b
Use target branch name into the PR subject line
shreeya-patel98 Nov 5, 2025
f0e27bd
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
shreeya-patel98 Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/kernel-build-and-test-x86_64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -512,13 +512,13 @@ jobs:
if [ -n "$EXISTING_PR" ]; then
echo "PR #$EXISTING_PR already exists, updating it"
gh pr edit "$EXISTING_PR" \
--title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \
--title "[$BASE_BRANCH] ${{ steps.commit_msg.outputs.commit_subject }}" \
--body-file pr_body.md
else
echo "Creating new PR from ${{ github.ref_name }} to $BASE_BRANCH"
gh pr create \
--base "$BASE_BRANCH" \
--head "${{ github.ref_name }}" \
--title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \
--title "[$BASE_BRANCH] ${{ steps.commit_msg.outputs.commit_subject }}" \
--body-file pr_body.md
fi
11 changes: 9 additions & 2 deletions fs/nfs/export.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,14 +66,21 @@ nfs_fh_to_dentry(struct super_block *sb, struct fid *fid,
{
struct nfs_fattr *fattr = NULL;
struct nfs_fh *server_fh = nfs_exp_embedfh(fid->raw);
size_t fh_size = offsetof(struct nfs_fh, data) + server_fh->size;
size_t fh_size = offsetof(struct nfs_fh, data);
const struct nfs_rpc_ops *rpc_ops;
struct dentry *dentry;
struct inode *inode;
int len = EMBED_FH_OFF + XDR_QUADLEN(fh_size);
int len = EMBED_FH_OFF;
u32 *p = fid->raw;
int ret;

/* Initial check of bounds */
if (fh_len < len + XDR_QUADLEN(fh_size) ||
fh_len > XDR_QUADLEN(NFS_MAXFHSIZE))
return NULL;
/* Calculate embedded filehandle size */
fh_size += server_fh->size;
len += XDR_QUADLEN(fh_size);
/* NULL translates to ESTALE */
if (fh_len < len || fh_type != len)
return NULL;
Expand Down
Loading