lkml.org 
[lkml]   [2020]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 302/391] NFSD: Add missing NFSv2 .pc_func methods
    Date
    From: Chuck Lever <chuck.lever@oracle.com>

    commit 6b3dccd48de8a4c650b01499a0b09d1e2279649e upstream.

    There's no protection in nfsd_dispatch() against a NULL .pc_func
    helpers. A malicious NFS client can trigger a crash by invoking the
    unused/unsupported NFSv2 ROOT or WRITECACHE procedures.

    The current NFSD dispatcher does not support returning a void reply
    to a non-NULL procedure, so the reply to both of these is wrong, for
    the moment.

    Cc: <stable@vger.kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/nfsd/nfsproc.c | 16 ++++++++++++++++
    1 file changed, 16 insertions(+)

    --- a/fs/nfsd/nfsproc.c
    +++ b/fs/nfsd/nfsproc.c
    @@ -118,6 +118,13 @@ done:
    return nfsd_return_attrs(nfserr, resp);
    }

    +/* Obsolete, replaced by MNTPROC_MNT. */
    +static __be32
    +nfsd_proc_root(struct svc_rqst *rqstp)
    +{
    + return nfs_ok;
    +}
    +
    /*
    * Look up a path name component
    * Note: the dentry in the resp->fh may be negative if the file
    @@ -203,6 +210,13 @@ nfsd_proc_read(struct svc_rqst *rqstp)
    return fh_getattr(&resp->fh, &resp->stat);
    }

    +/* Reserved */
    +static __be32
    +nfsd_proc_writecache(struct svc_rqst *rqstp)
    +{
    + return nfs_ok;
    +}
    +
    /*
    * Write data to a file
    * N.B. After this call resp->fh needs an fh_put
    @@ -617,6 +631,7 @@ static const struct svc_procedure nfsd_p
    .pc_xdrressize = ST+AT,
    },
    [NFSPROC_ROOT] = {
    + .pc_func = nfsd_proc_root,
    .pc_decode = nfssvc_decode_void,
    .pc_encode = nfssvc_encode_void,
    .pc_argsize = sizeof(struct nfsd_void),
    @@ -654,6 +669,7 @@ static const struct svc_procedure nfsd_p
    .pc_xdrressize = ST+AT+1+NFSSVC_MAXBLKSIZE_V2/4,
    },
    [NFSPROC_WRITECACHE] = {
    + .pc_func = nfsd_proc_writecache,
    .pc_decode = nfssvc_decode_void,
    .pc_encode = nfssvc_encode_void,
    .pc_argsize = sizeof(struct nfsd_void),

    \
     
     \ /
      Last update: 2020-11-03 22:50    [W:2.503 / U:0.160 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site