patches for 4.1
Subsystems (2)
These fix a couple bugs I noticed (plus one Christoph caught) while reviewing some nfsd permissions checking (partly for richacl review).
I'll probably send my 4.1 pull request tomorrow, with these (and the rest mostly small bugfixes too).
--b.
PATCH 1/3 nfsd4: disallow ALLOCATE with special stateids
From: "J. Bruce Fields" <[email protected]>
vfs_fallocate will hit a NULL dereference if the client tries an ALLOCATE or DEALLOCATE with a special stateid. Fix that. (We also depend on the open to have broken any conflicting leases or delegations for us.)
(If it turns out we need to allow special stateid's then we could do a temporary open here in the special-stateid case, as we do for read and write. For now I'm assuming it's not necessary.)
--- fs/nfsd/nfs4proc.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfsd/nfs4proc.c +2 -0
@@ -1030,6 +1030,8 @@ nfsd4_fallocate(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,dprintk ("NFSD: nfsd4_fallocate: couldn't process stateid!\n" );return status; } +if (!file) +return nfserr_bad_stateid; status = nfsd4_vfs_fallocate(rqstp, &cstate->current_fh, file, fallocate->falloc_offset,
Signature · 1 line
1.9.3
PATCH 2/3 nfsd4: disallow SEEK with special stateids
In reply to J. Bruce FieldsFrom: "J. Bruce Fields" <[email protected]>
If the client uses a special stateid then we'll pass a NULL file to vfs_llseek.
--- fs/nfsd/nfs4proc.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfsd/nfs4proc.c +2 -0
@@ -1071,6 +1071,8 @@ nfsd4_seek(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,dprintk ("NFSD: nfsd4_seek: couldn't process stateid!\n" );return status; } +if (!file) +return nfserr_bad_stateid;switch (seek->seek_whence) {case NFS4_CONTENT_DATA :
Signature · 1 line
1.9.3
Re: [PATCH 2/3] nfsd4: disallow SEEK with special stateids
Quoted 4 lines · J. Bruce Fields
From: "J. Bruce Fields" <[email protected]>
If the client uses a special stateid then we'll pass a NULL file to
vfs_llseek.
By the way, Christoph has also pointed out that it's probably worth fixing nfsd4_preprocess_stateid_op() to do a temporary open itself in the special stateid case.
If we wanted to get nfsd4_preprocess_stateid_op() to the point where it also returned a file (if requested) on success, then there'd also be the possible NULL returns from find_{read|write}able_file() to handle.
I haven't figured that out yet.
--b.
Quoted 30 lines
Fixes 24bab491220f " NFSD: Implement SEEK"Cc Anna Schumaker <[email protected]>Reported-by Christoph Hellwig <[email protected]>Signed-off-by J. Bruce Fields <[email protected]>--- fs/nfsd/nfs4proc.c | 2 ++ 1 file changed, 2 insertions(+)fs/nfsd/nfs4proc.c +2
-0@@ -1071,6 +1071,8 @@ nfsd4_seek(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,dprintk ("NFSD: nfsd4_seek: couldn't process stateid!\n" );return status; } +if (!file) +return nfserr_bad_stateid;switch (seek->seek_whence) {case NFS4_CONTENT_DATA :Signature · 6 lines
1.9.3 -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
PATCH 3/3 nfsd4: fix READ permission checking
In reply to J. Bruce FieldsFrom: "J. Bruce Fields" <[email protected]>
In the case we already have a struct file (derived from a stateid), we still need to do permission-checking; otherwise an unauthorized user could gain access to a file by sniffing or guessing somebody else's stateid.
--- fs/nfsd/nfs4xdr.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/nfsd/nfs4xdr.c +8 -4
@@ -3422,6 +3422,7 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,unsigned long maxcount;struct xdr_stream *xdr = &resp->xdr;struct file *file = read->rd_filp; +struct svc_fh *fhp = read->rd_fhp;int starting_len = xdr->buf->len;struct raparms *ra;__be32 *p;
@@ -3445,12 +3446,15 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr, maxcount = min_t(unsigned long, maxcount, (xdr->buf->buflen - xdr->buf->len)); maxcount = min_t(unsigned long, maxcount, read->rd_length); -if (!read->rd_filp) { +if (read->rd_filp) + err =nfsd_permission (resp->rqstp, fhp->fh_export, + fhp->fh_dentry, +NFSD_MAY_READ |NFSD_MAY_OWNER_OVERRIDE ); +else err =nfsd_get_tmp_read_open (resp->rqstp, read->rd_fhp, &file, &ra); -if (err) - goto err_truncate; - } +if (err) + goto err_truncate;if (file->f_op->splice_read &&test_bit (RQ_SPLICE_OK , &resp->rqstp->rq_flags)) err =nfsd4_encode_splice_read (resp, read, file, maxcount);
Signature · 1 line
1.9.3