Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a084daf5 authored by J. Bruce Fields's avatar J. Bruce Fields
Browse files

nfsd4: move name-length checks to xdr 



Again, these checks are better in the xdr code.

Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 04f9e664

fs/nfsd/nfs4state.c

+2 −22
Original line number Diff line number Diff line
@@ -1189,17 +1189,6 @@ static struct nfs4_client *create_client(struct xdr_netobj name, char *recdir, 
	return clp;

}



static int check_name(struct xdr_netobj name)

{

	if (name.len == 0) 

		return 0;

	if (name.len > NFS4_OPAQUE_LIMIT) {

		dprintk("NFSD: check_name: name too long(%d)!\n", name.len);

		return 0;

	}

	return 1;

}



static void

add_to_unconfirmed(struct nfs4_client *clp, unsigned int strhashval)

{
@@ -1442,7 +1431,7 @@ nfsd4_exchange_id(struct svc_rqst *rqstp, 
		__func__, rqstp, exid, exid->clname.len, exid->clname.data,

		addr_str, exid->flags, exid->spa_how);



	if (!check_name(exid->clname) || (exid->flags & ~EXCHGID4_FLAG_MASK_A))

	if (exid->flags & ~EXCHGID4_FLAG_MASK_A)

		return nfserr_inval;



	/* Currently only support SP4_NONE */
@@ -1992,19 +1981,13 @@ __be32 
nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,

		  struct nfsd4_setclientid *setclid)

{

	struct xdr_netobj 	clname = { 

		.len = setclid->se_namelen,

		.data = setclid->se_name,

	};

	struct xdr_netobj 	clname = setclid->se_name;

	nfs4_verifier		clverifier = setclid->se_verf;

	unsigned int 		strhashval;

	struct nfs4_client	*conf, *unconf, *new;

	__be32 			status;

	char                    dname[HEXDIR_LEN];

	

	if (!check_name(clname))

		return nfserr_inval;



	status = nfs4_make_rec_clidname(dname, &clname);

	if (status)

		return status;
@@ -2523,9 +2506,6 @@ nfsd4_process_open1(struct nfsd4_compound_state *cstate, 
	struct nfs4_openowner *oo = NULL;

	__be32 status;



	if (!check_name(open->op_owner))

		return nfserr_inval;



	if (STALE_CLIENTID(&open->op_clientid))

		return nfserr_stale_clientid;

fs/nfsd/nfs4xdr.c

+30 −15
Original line number Diff line number Diff line
@@ -697,6 +697,23 @@ static __be32 nfsd4_decode_share_deny(struct nfsd4_compoundargs *argp, u32 *x) 
	return nfserr_bad_xdr;

}



static __be32 nfsd4_decode_opaque(struct nfsd4_compoundargs *argp, struct xdr_netobj *o)

{

	__be32 *p;



	READ_BUF(4);

	READ32(o->len);



	if (o->len == 0 || o->len > NFS4_OPAQUE_LIMIT)

		return nfserr_bad_xdr;



	READ_BUF(o->len);

	SAVEMEM(o->data, o->len);

	return nfs_ok;

xdr_error:

	return nfserr_bad_xdr;

}



static __be32

nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)

{
@@ -715,13 +732,12 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open) 
	status = nfsd4_decode_share_deny(argp, &open->op_share_deny);

	if (status)

		goto xdr_error;

	READ_BUF(sizeof(clientid_t) + 4);

	READ_BUF(sizeof(clientid_t));

	COPYMEM(&open->op_clientid, sizeof(clientid_t));

	READ32(open->op_owner.len);



	/* owner, open_flag */

	READ_BUF(open->op_owner.len + 4);

	SAVEMEM(open->op_owner.data, open->op_owner.len);

	status = nfsd4_decode_opaque(argp, &open->op_owner);

	if (status)

		goto xdr_error;

	READ_BUF(4);

	READ32(open->op_create);

	switch (open->op_create) {

	case NFS4_OPEN_NOCREATE:
@@ -964,12 +980,13 @@ nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclient 
{

	DECODE_HEAD;



	READ_BUF(12);

	READ_BUF(8);

	COPYMEM(setclientid->se_verf.data, 8);

	READ32(setclientid->se_namelen);



	READ_BUF(setclientid->se_namelen + 8);

	SAVEMEM(setclientid->se_name, setclientid->se_namelen);

	status = nfsd4_decode_opaque(argp, &setclientid->se_name);

	if (status)

		return nfserr_bad_xdr;

	READ_BUF(8);

	READ32(setclientid->se_callback_prog);

	READ32(setclientid->se_callback_netid_len);
@@ -1112,11 +1129,9 @@ nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp, 
	READ_BUF(NFS4_VERIFIER_SIZE);

	COPYMEM(exid->verifier.data, NFS4_VERIFIER_SIZE);



	READ_BUF(4);

	READ32(exid->clname.len);



	READ_BUF(exid->clname.len);

	SAVEMEM(exid->clname.data, exid->clname.len);

	status = nfsd4_decode_opaque(argp, &exid->clname);

	if (status)

		return nfserr_bad_xdr;



	READ_BUF(4);

	READ32(exid->flags);

fs/nfsd/xdr4.h

+1 −2
Original line number Diff line number Diff line
@@ -317,8 +317,7 @@ struct nfsd4_setattr { 


struct nfsd4_setclientid {

	nfs4_verifier	se_verf;            /* request */

	u32		se_namelen;         /* request */

	char *		se_name;            /* request */

	struct xdr_netobj se_name;

	u32		se_callback_prog;   /* request */

	u32		se_callback_netid_len;  /* request */

	char *		se_callback_netid_val;  /* request */