Re: [PATCH v3 1/3] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

On Tue, 16 Jun 2026 13:39:58 +0800, robbieko wrote:
> The NFSv2 sattr decoder converts the wire useconds to nanoseconds in
> svcxdr_decode_sattr():
> 
> 	iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;
> 
> tmp2 is a u32 and NSEC_PER_USEC is 1000, so the product is computed in
> unsigned long. On ILP32 that is 32 bits, and an out-of-range useconds
> value such as 4294968 wraps to tv_nsec == 704. The corruption therefore
> happens during decode, before any proc function can inspect the value,
> and a later range check on tv_nsec would see an in-range result and
> accept it.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/3] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
      commit: 5a6e45730d33afefe6ac1208173365840314dfd9
[2/3] nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
      commit: ccf2a0a8a51b8fa23bd4e4413e01b57a81451c7f
[3/3] nfsd: use NSEC_PER_SEC in nfsd4_decode_nfstime4()
      commit: 324975079e798c30a15d23396c51216937389baf

--
Chuck Lever