[PATCH] NFS: clamp WRITE reply count to the requested count

[Cheng Yongkang]

nfs_writeback_update_inode() uses the server's WRITE reply count for the
size update before nfs_writeback_result() compares it with the request.
That comparison only rejects a smaller count, so a server can return a
count larger than the request, make nfs_writeback_check_extend() set
fattr->size beyond the requested extent, and grow the client inode's
i_size.

Clamp the reply count to args.count before the size update.  This keeps
the attribute barrier and completion accounting within the write the
client actually issued.

The inflation was reproduced 3/3 times with a fake NFSv4.0 server that
answered a 1-byte WRITE with count 0x40000000; with this clamp the
client keeps i_size at 1.  A reply with the requested count still gives
i_size=1.

Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@xxxxxxxxx>
---
 fs/nfs/write.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 623e7ef..0dbcaeb 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1467,6 +1467,13 @@ void nfs_writeback_update_inode(struct nfs_pgio_header *hdr)
 	struct nfs_fattr *fattr = &hdr->fattr;
 	struct inode *inode = hdr->inode;
 
+	/*
+	 * A server may report more bytes than the request asked for.  Do not
+	 * let that count extend the inode size or the attribute barrier.
+	 */
+	if (hdr->res.count > hdr->args.count)
+		hdr->res.count = hdr->args.count;
+
 	if (nfs_have_delegated_mtime(inode)) {
 		spin_lock(&inode->i_lock);
 		nfs_set_cache_invalid(inode, NFS_INO_INVALID_BLOCKS);
-- 
2.34.1