In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix partial-write detection in nfsd_direct_write<\/p>\n
nfsd_direct_write() walks a list of write segments and, after each
\nvfs_iocb_iter_write(), tries to detect a short write so the loop can
\nstop before placing the next segment at a wrong file offset:<\/p>\n
host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);
\n if (host_err < 0)
\n return host_err;
\n *cnt += host_err;
\n if (host_err write_iter(), which
\nadvances the iter by the number of bytes written. By the time the
\ncheck runs, segments[i].iter.count is the residual, not the original
\nrequest length:<\/p>\n
before write_iter: iter.count == original_len
\n after write_iter: iter.count == original_len – host_err<\/p>\n
The condition then reduces to host_err ki_pos
\nonly bumped by the short amount, writing the next segment’s payload
\nat the wrong offset and over-reporting *cnt to the NFS client.<\/p>\n
Snapshot the segment’s byte count before the write and compare
\nhost_err against that snapshot so any short write breaks the loop.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix partial-write detection in nfsd_direct_write<\/p>\n
nfsd_direct_write() walks a list of write segments and, after each
\nvfs_iocb<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21600","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}