Re: [PATCH] nfsd: truncate LISTXATTRS replies on error

[Chuck Lever]

On Wed, 21 Oct 2026 11:37:15 +0900, Hyunsol Mun wrote:
> nfsd4_encode_listxattrs() reserves 12 bytes for the reply cookie and
> array count before it starts encoding attribute names. If the first user
> attribute name does not fit in the client's maxcount, the encoder returns
> NFS4ERR_TOOSMALL without initializing the reservation.
> 
> The generic COMPOUND encoder does not truncate replies for this error, so
> the reserved bytes are transmitted after the operation status and can
> disclose stale reply-buffer contents.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: truncate LISTXATTRS replies on error
      commit: cab30e6ab042c665e54bc9408e9c7b7550417845

--
Chuck Lever