Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88401813 authored by Chuck Lever's avatar Chuck Lever Committed by Greg Kroah-Hartman
Browse files

NFSD: Add missing NFSv2 .pc_func methods 



commit 6b3dccd48de8a4c650b01499a0b09d1e2279649e upstream.

There's no protection in nfsd_dispatch() against a NULL .pc_func
helpers. A malicious NFS client can trigger a crash by invoking the
unused/unsupported NFSv2 ROOT or WRITECACHE procedures.

The current NFSD dispatcher does not support returning a void reply
to a non-NULL procedure, so the reply to both of these is wrong, for
the moment.

Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3c040b92

fs/nfsd/nfsproc.c

+16 −0
Original line number Diff line number Diff line
@@ -118,6 +118,13 @@ nfsd_proc_setattr(struct svc_rqst *rqstp) 
	return nfsd_return_attrs(nfserr, resp);

}



/* Obsolete, replaced by MNTPROC_MNT. */

static __be32

nfsd_proc_root(struct svc_rqst *rqstp)

{

	return nfs_ok;

}



/*

 * Look up a path name component

 * Note: the dentry in the resp->fh may be negative if the file
@@ -201,6 +208,13 @@ nfsd_proc_read(struct svc_rqst *rqstp) 
	return fh_getattr(&resp->fh, &resp->stat);

}



/* Reserved */

static __be32

nfsd_proc_writecache(struct svc_rqst *rqstp)

{

	return nfs_ok;

}



/*

 * Write data to a file

 * N.B. After this call resp->fh needs an fh_put
@@ -615,6 +629,7 @@ static const struct svc_procedure nfsd_procedures2[18] = { 
		.pc_xdrressize = ST+AT,

	},

	[NFSPROC_ROOT] = {

		.pc_func = nfsd_proc_root,

		.pc_decode = nfssvc_decode_void,

		.pc_encode = nfssvc_encode_void,

		.pc_argsize = sizeof(struct nfsd_void),
@@ -652,6 +667,7 @@ static const struct svc_procedure nfsd_procedures2[18] = { 
		.pc_xdrressize = ST+AT+1+NFSSVC_MAXBLKSIZE_V2/4,

	},

	[NFSPROC_WRITECACHE] = {

		.pc_func = nfsd_proc_writecache,

		.pc_decode = nfssvc_decode_void,

		.pc_encode = nfssvc_encode_void,

		.pc_argsize = sizeof(struct nfsd_void),