[PATCH] nfsd: fix replay buffer length underflow in nfsd4_encode_operation

[Xiaobo Liu]

When nfsd4_encode_operation() truncates the reply back to
op_status_offset + XDR_UNIT, the replay-cache path may still try to
compute the encoded payload length from xdr->buf->len.

If xdr->buf->len is smaller than op_status_offset + XDR_UNIT, the
subtraction underflows and the result is assigned to an int. That can
produce an invalid negative/small value, allowing the subsequent
NFSD4_REPLAY_ISIZE check to make the wrong decision and use a bogus
length for replay-buffer handling.

Fix this by validating the buffer length before subtracting. If the
encoded length would underflow, force the value into the "too large to
cache" path so rp_buflen is cleared instead of reading invalid data.

Signed-off-by: Xiaobo Liu <cppcoffee@xxxxxxxxx>
---
 fs/nfsd/nfs4xdr.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 9d2349131..5e9e49057 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6278,9 +6278,14 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
 		warn_on_nonidempotent_op(op);
 		xdr_truncate_encode(xdr, op_status_offset + XDR_UNIT);
 	} else if (so) {
-		int len = xdr->buf->len - (op_status_offset + XDR_UNIT);
+		unsigned int len;
 
 		so->so_replay.rp_status = op->status;
+		if (xdr->buf->len >= op_status_offset + XDR_UNIT) {
+			len = xdr->buf->len - (op_status_offset + XDR_UNIT);
+		} else {
+			len = NFSD4_REPLAY_ISIZE + 1;
+		}
 		if (len <= NFSD4_REPLAY_ISIZE) {
 			so->so_replay.rp_buflen = len;
 			read_bytes_from_xdr_buf(xdr->buf,
-- 
2.34.1