From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-bl2nam02on0126.outbound.protection.outlook.com ([104.47.38.126]:63839 "EHLO NAM02-BL2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032329AbeCAPcZ (ORCPT ); Thu, 1 Mar 2018 10:32:25 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: Andrew Elble , "J . Bruce Fields" , Sasha Levin Subject: [added to the 4.1 stable tree] nfsd: check for use of the closed special stateid Date: Thu, 1 Mar 2018 15:25:28 +0000 Message-ID: <20180301152116.1486-270-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Andrew Elble This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit ae254dac721d44c0bfebe2795df87459e2e88219 ] Prevent the use of the closed (invalid) special stateid by clients. Signed-off-by: Andrew Elble Signed-off-by: J. Bruce Fields Signed-off-by: Sasha Levin --- fs/nfsd/nfs4state.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 72019f141ebc..322cf41b5257 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -72,6 +72,7 @@ static u64 current_sessionid =3D 1; #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(st= ateid_t))) #define ONE_STATEID(stateid) (!memcmp((stateid), &one_stateid, sizeof(sta= teid_t))) #define CURRENT_STATEID(stateid) (!memcmp((stateid), ¤tstateid, size= of(stateid_t))) +#define CLOSE_STATEID(stateid) (!memcmp((stateid), &close_stateid, sizeof= (stateid_t))) =20 /* forward declarations */ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *l= owner); @@ -4618,7 +4619,8 @@ static __be32 nfsd4_validate_stateid(struct nfs4_clie= nt *cl, stateid_t *stateid) struct nfs4_stid *s; __be32 status =3D nfserr_bad_stateid; =20 - if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) + if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) || + CLOSE_STATEID(stateid)) return status; /* Client debugging aid. */ if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) { @@ -4676,7 +4678,8 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cst= ate, else if (typemask & NFS4_DELEG_STID) typemask |=3D NFS4_REVOKED_DELEG_STID; =20 - if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) + if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) || + CLOSE_STATEID(stateid)) return nfserr_bad_stateid; status =3D lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn); if (status =3D=3D nfserr_stale_clientid) { --=20 2.14.1