All of lore.kernel.org
 help / color / mirror / Atom feed
From: Chuck Lever <chuck.lever@oracle.com>
To: bfields@fieldses.org
Cc: linux-nfs@vger.kernel.org
Subject: [PATCH v3 02/15] NFSD: Add missing NFSv2 .pc_func methods
Date: Thu, 01 Oct 2020 18:58:56 -0400	[thread overview]
Message-ID: <160159313695.79253.2027381422043199787.stgit@klimt.1015granger.net> (raw)
In-Reply-To: <160159301676.79253.16488984581431975601.stgit@klimt.1015granger.net>

There's no protection in nfsd_dispatch() against a NULL .pc_func
helpers. A malicious NFS client can trigger a crash by invoking the
unused/unsupported NFSv2 ROOT or WRITECACHE procedures.

The current NFSD dispatcher does not support returning a void reply
to a non-NULL procedure, so the reply to both of these is wrong, for
the moment.

Cc: <stable@vger.kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 fs/nfsd/nfsproc.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index 6e0b066480c5..6d1b3af40a4f 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -118,6 +118,13 @@ nfsd_proc_setattr(struct svc_rqst *rqstp)
 	return nfsd_return_attrs(nfserr, resp);
 }
 
+/* Obsolete, replaced by MNTPROC_MNT. */
+static __be32
+nfsd_proc_root(struct svc_rqst *rqstp)
+{
+	return nfs_ok;
+}
+
 /*
  * Look up a path name component
  * Note: the dentry in the resp->fh may be negative if the file
@@ -203,6 +210,13 @@ nfsd_proc_read(struct svc_rqst *rqstp)
 	return fh_getattr(&resp->fh, &resp->stat);
 }
 
+/* Reserved */
+static __be32
+nfsd_proc_writecache(struct svc_rqst *rqstp)
+{
+	return nfs_ok;
+}
+
 /*
  * Write data to a file
  * N.B. After this call resp->fh needs an fh_put
@@ -617,6 +631,7 @@ static const struct svc_procedure nfsd_procedures2[18] = {
 		.pc_xdrressize = ST+AT,
 	},
 	[NFSPROC_ROOT] = {
+		.pc_func = nfsd_proc_root,
 		.pc_decode = nfssvc_decode_void,
 		.pc_encode = nfssvc_encode_void,
 		.pc_argsize = sizeof(struct nfsd_void),
@@ -654,6 +669,7 @@ static const struct svc_procedure nfsd_procedures2[18] = {
 		.pc_xdrressize = ST+AT+1+NFSSVC_MAXBLKSIZE_V2/4,
 	},
 	[NFSPROC_WRITECACHE] = {
+		.pc_func = nfsd_proc_writecache,
 		.pc_decode = nfssvc_decode_void,
 		.pc_encode = nfssvc_encode_void,
 		.pc_argsize = sizeof(struct nfsd_void),



  parent reply	other threads:[~2020-10-01 22:59 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-01 22:58 [PATCH v3 00/15] nfsd_dispatch() clean up Chuck Lever
2020-10-01 22:58 ` [PATCH v3 01/15] nfsd: rq_lease_breaker cleanup Chuck Lever
2020-10-01 22:58 ` Chuck Lever [this message]
2020-10-01 22:59 ` [PATCH v3 03/15] lockd: Replace PROC() macro with open code Chuck Lever
2020-10-01 22:59 ` [PATCH v3 04/15] NFSACL: " Chuck Lever
2020-10-01 22:59 ` [PATCH v3 05/15] NFSD: Encoder and decoder functions are always present Chuck Lever
2020-10-01 22:59 ` [PATCH v3 06/15] NFSD: Clean up switch statement in nfsd_dispatch() Chuck Lever
2020-10-01 22:59 ` [PATCH v3 07/15] NFSD: Clean up stale comments " Chuck Lever
2020-10-01 22:59 ` [PATCH v3 08/15] NFSD: Clean up nfsd_dispatch() variables Chuck Lever
2020-10-01 22:59 ` [PATCH v3 09/15] NFSD: Refactor nfsd_dispatch() error paths Chuck Lever
2020-10-01 22:59 ` [PATCH v3 10/15] NFSD: Remove vestigial typedefs Chuck Lever
2020-10-01 22:59 ` [PATCH v3 11/15] NFSD: Fix .pc_release method for NFSv2 Chuck Lever
2020-10-01 22:59 ` [PATCH v3 12/15] NFSD: Call NFSv2 encoders on error returns Chuck Lever
2020-10-01 22:59 ` [PATCH v3 13/15] NFSD: Remove the RETURN_STATUS() macro Chuck Lever
2020-10-01 23:00 ` [PATCH v3 14/15] NFSD: Map nfserr_wrongsec outside of nfsd_dispatch Chuck Lever
2020-10-01 23:00 ` [PATCH v3 15/15] NFSD: Hoist status code encoding into XDR encoder functions Chuck Lever
2020-10-02 17:39 ` [PATCH v3 00/15] nfsd_dispatch() clean up J. Bruce Fields
2020-10-02 17:42   ` J. Bruce Fields
2020-10-02 17:44     ` Chuck Lever

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=160159313695.79253.2027381422043199787.stgit@klimt.1015granger.net \
    --to=chuck.lever@oracle.com \
    --cc=bfields@fieldses.org \
    --cc=linux-nfs@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.