Skip to contentSkip to conversation

Patch "NFSv4: Fix EXCHANGE_ID corrupt verifier issue" has been added to the 4.12-stable tree

PATCH [email protected] 1 participant 1 message Aug 7, 2017

Subsystems (2)
Stable branch NFS client
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

NFSv4: Fix EXCHANGE_ID corrupt verifier issue

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nfsv4-fix-exchange_id-corrupt-verifier-issue.patch
and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From fd40559c8657418385e42f797e0b04bfc0add748 Mon Sep 17 00:00:00 2001

From: Trond Myklebust <[email protected]>
Date: Tue, 1 Aug 2017 16:02:47 -0400
Subject: NFSv4: Fix EXCHANGE_ID corrupt verifier issue

From: Trond Myklebust <[email protected]>

commit fd40559c8657418385e42f797e0b04bfc0add748 upstream.

The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was changed to be asynchronous by commit 8d89bd70bc939. If we interrrupt the call to rpc_wait_for_completion_task(), we can therefore end up transmitting random stack contents in lieu of the verifier.

Fixes 8d89bd70bc939 ("NFS setup async exchange_id")
Signed-off-by Trond Myklebust <[email protected]>
Signed-off-by Anna Schumaker <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 fs/nfs/nfs4proc.c       |   11 ++++-------
 fs/nfs/nfs4xdr.c        |    2 +-
 include/linux/nfs_xdr.h |    2 +-
 3 files changed, 6 insertions(+), 9 deletions(-)
fs/nfs/nfs4proc.c +4 -7
@@ -7407,7 +7407,7 @@ static void nfs4_exchange_id_done(struct
 			cdata->res.server_scope = NULL;
 		}
 		/* Save the EXCHANGE_ID verifier session trunk tests */
-		memcpy(clp->cl_confirm.data, cdata->args.verifier->data,
+		memcpy(clp->cl_confirm.data, cdata->args.verifier.data,
 		       sizeof(clp->cl_confirm.data));
 	}
 out:

@@ -7444,7 +7444,6 @@ static const struct rpc_call_ops nfs4_ex
 static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
 			u32 sp4_how, struct rpc_xprt *xprt)
 {
-	nfs4_verifier verifier;
 	struct rpc_message msg = {
 		.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_EXCHANGE_ID],
 		.rpc_cred = cred,

@@ -7468,8 +7467,7 @@ static int _nfs4_proc_exchange_id(struct
 		return -ENOMEM;
 	}
 
-	if (!xprt)
-		nfs4_init_boot_verifier(clp, &verifier);
+	nfs4_init_boot_verifier(clp, &calldata->args.verifier);
 
 	status = nfs4_init_uniform_client_string(clp);
 	if (status)

@@ -7510,9 +7508,8 @@ static int _nfs4_proc_exchange_id(struct
 		task_setup_data.rpc_xprt = xprt;
 		task_setup_data.flags =
 				RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;
-		calldata->args.verifier = &clp->cl_confirm;
-	} else {
-		calldata->args.verifier = &verifier;
+		memcpy(calldata->args.verifier.data, clp->cl_confirm.data,
+				sizeof(calldata->args.verifier.data));
 	}
 	calldata->args.client = clp;
 #ifdef CONFIG_NFS_V4_1_MIGRATION
fs/nfs/nfs4xdr.c +1 -1
@@ -1765,7 +1765,7 @@ static void encode_exchange_id(struct xd
 	int len = 0;
 
 	encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);
-	encode_nfs4_verifier(xdr, args->verifier);
+	encode_nfs4_verifier(xdr, &args->verifier);
 
 	encode_string(xdr, strlen(args->client->cl_owner_id),
 			args->client->cl_owner_id);
include/linux/nfs_xdr.h +1 -1
@@ -1222,7 +1222,7 @@ struct nfs41_state_protection {
 
 struct nfs41_exchange_id_args {
 	struct nfs_client		*client;
-	nfs4_verifier			*verifier;
+	nfs4_verifier			verifier;
 	u32				flags;
 	struct nfs41_state_protection	state_protect;
 };

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/nfsv4-fix-exchange_id-corrupt-verifier-issue.patch