Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e874f9f8 authored by Jeff Layton's avatar Jeff Layton Committed by J. Bruce Fields
Browse files

svcrpc: explicitly reject compounds that are not padded out to 4-byte multiple 



We have a WARN_ON in the nfsd4_decode_write() that tells us when the
client has sent a request that is not padded out properly according to
RFC4506. A WARN_ON really isn't appropriate in this case though since
this indicates a client bug, not a server one.

Move this check out to the top-level compound decoder and have it just
explicitly return an error. Also add a dprintk() that shows the client
address and xid to help track down clients and frames that trigger it.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 45481201

fs/nfsd/nfs4xdr.c

+6 −1
Original line number Original line Diff line number Diff line
@@ -1222,7 +1222,6 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write) 
	}

	}

	write->wr_head.iov_base = p;

	write->wr_head.iov_base = p;

	write->wr_head.iov_len = avail;

	write->wr_head.iov_len = avail;

	WARN_ON(avail != (XDR_QUADLEN(avail) << 2));

	write->wr_pagelist = argp->pagelist;

	write->wr_pagelist = argp->pagelist;





	len = XDR_QUADLEN(write->wr_buflen) << 2;

	len = XDR_QUADLEN(write->wr_buflen) << 2;
@@ -3696,6 +3695,12 @@ int nfsd4_release_compoundargs(void *rq, __be32 *p, void *resp) 
int

int

nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd4_compoundargs *args)

nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd4_compoundargs *args)

{

{

	if (rqstp->rq_arg.head[0].iov_len % 4) {

		/* client is nuts */

		dprintk("%s: compound not properly padded! (peeraddr=%pISc xid=0x%x)",

			__func__, svc_addr(rqstp), be32_to_cpu(rqstp->rq_xid));

		return 0;

	}

	args->p = p;

	args->p = p;

	args->end = rqstp->rq_arg.head[0].iov_base + rqstp->rq_arg.head[0].iov_len;

	args->end = rqstp->rq_arg.head[0].iov_base + rqstp->rq_arg.head[0].iov_len;

	args->pagelist = rqstp->rq_arg.pages;

	args->pagelist = rqstp->rq_arg.pages;