Received-SPF: pass (google.com: domain of linux-nfs+bounces-3453-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
MIME-Version: 1.0
From: "NeilBrown" <neilb@suse.de>
To: Trond Myklebust <trond.myklebust@hammerspace.com>,
 Anna Schumaker <anna@kernel.org>
Cc: james.clark@arm.com, ltp@lists.linux.it, broonie@kernel.org,
 Aishwarya.TCV@arm.com, linux-nfs@vger.kernel.org
Subject: [PATCH] NFS: abort nfs_atomic_open_v23 if name is too long.
Date: Wed, 29 May 2024 09:11:36 +1000
Message-id: <171693789645.27191.13475059024941012614@noble.neil.brown.name>


An attempt to open a file with a name longer than NFS3_MAXNAMLEN will
trigger a WARN_ON_ONCE in encode_filename3() because
nfs_atomic_open_v23() doesn't have the test on ->d_name.len that
nfs_atomic_open() has.

So add that test.

Reported-by: James Clark <james.clark@arm.com>
Closes: https://lore.kernel.org/all/20240528105249.69200-1-james.clark@arm.co=
m/
Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correc=
tly.")
Signed-off-by: NeilBrown <neilb@suse.de>
---
 fs/nfs/dir.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 342930996226..2b09b5416ef1 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2255,6 +2255,9 @@ int nfs_atomic_open_v23(struct inode *dir, struct dentr=
y *dentry,
 	 */
 	int error =3D 0;
=20
+	if (dentry->d_name.len > NFS_SERVER(dir)->namelen)
+		return -ENAMETOOLONG;
+
 	if (open_flags & O_CREAT) {
 		file->f_mode |=3D FMODE_CREATED;
 		error =3D nfs_do_create(dir, dentry, mode, open_flags);
--=20
2.44.0