After a successful spliced READ, nfsd points the XDR tail at the unused bytes remaining in the first response page, so that later operation results are written into that space. nfsd4_encode_splice_read() correctly computes how much space is left there, but then moves xdr->end from its old value instead of using xdr->p. This gives the tail an incorrect size limit, which can cause an OOB write past the end of the page. Keep the tail end at the current pointer plus the bounded remaining space. Fixes: 30596768b310 ("nfsd4: fix buflen calculation after read encoding") Cc: stable@vger.kernel.org Signed-off-by: Jérémy Jean --- fs/nfsd/nfs4xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index 606ddcb085c0..2f92b6dfd92c 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -5200,7 +5200,7 @@ static __be32 nfsd4_encode_splice_read( space_left = min_t(int, (void *)xdr->end - (void *)xdr->p, buf->buflen - buf->len); buf->buflen = buf->len + space_left; - xdr->end = (__be32 *)((void *)xdr->end + space_left); + xdr->end = (__be32 *)((void *)xdr->p + space_left); return nfs_ok; -- 2.47.3