[PATCH 1/9] NFSD: Budget the CB_SEQUENCE opcode and referring call array count

Chuck Lever <[email protected]> Sun, 02 Aug 2026 13:04:28 -0400
Newsgroups gmane.linux.nfs
Message-ID <20260802-nfsd-deleg-destroy-badhandle-v1-1-323aa7196055@kernel.org>
cb_sequence_enc_sz counts the session ID, the four scalar fields, and
one referring call list. encode_cb_sequence4args() also emits the
CB_SEQUENCE opcode and the csa_referring_call_lists array count, so
the macro falls two XDR words short. Every NFS4_enc_cb_*_sz built on
it is short by the same two words.

NFSD_CB_MAX_REQ_SZ derives from NFS4_enc_cb_recall_sz, so the two
missing CB_SEQUENCE words shrink the ca_maxrequestsize that
check_backchannel_attrs() accepts by eight bytes. Count both words.
The minimum a client must advertise rises by those eight bytes.

The short count cannot overrun the send buffer. The macro sizes
p_arglen, and rq_callsize adds two credential slacks on top of that.
The only client affected is one whose ca_maxrequestsize falls inside
those eight bytes. No backport is needed.

Signed-off-by: Chuck Lever <[email protected]>
---
 fs/nfsd/xdr4cb.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/xdr4cb.h b/fs/nfsd/xdr4cb.h
index b06d0170d7c4..04d3e321a972 100644
--- a/fs/nfsd/xdr4cb.h
+++ b/fs/nfsd/xdr4cb.h
@@ -6,14 +6,14 @@
 #define cb_compound_enc_hdr_sz		4
 #define cb_compound_dec_hdr_sz		(3 + (NFS4_MAXTAGLEN >> 2))
 #define sessionid_sz			(NFS4_MAX_SESSIONID_LEN >> 2)
+#define op_enc_sz			1
 #define enc_referring_call4_sz		(1 + 1)
 #define enc_referring_call_list4_sz	(sessionid_sz + 1 + \
 					enc_referring_call4_sz)
-#define cb_sequence_enc_sz		(sessionid_sz + 4 +             \
-					enc_referring_call_list4_sz)
+#define cb_sequence_enc_sz		(op_enc_sz + sessionid_sz + 4 + \
+					1 + enc_referring_call_list4_sz)
 #define cb_sequence_dec_sz		(op_dec_sz + sessionid_sz + 4)
 
-#define op_enc_sz			1
 #define op_dec_sz			2
 #define enc_nfs4_fh_sz			(1 + (NFS4_FHSIZE >> 2))
 #define enc_stateid_sz			(NFS4_STATEID_SIZE >> 2)

-- 
2.54.0