Attachment 858114 Details for Bug 1050206 – NFSv4: Fix memory corruption in nfs4_proc_open_confirm

[patch] NFSv4: Fix memory corruption in nfs4_proc_open_confirm

0001-NFSv4-Fix-memory-corruption-in-nfs4_proc_open_confir.patch (text/plain), 2.34 KB, created by Trond Myklebust on 2014-02-01 20:17:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Trond Myklebust

Created: 2014-02-01 20:17:06 UTC

Size: 2.34 KB

patch

obsolete

>From 17ead6c85c3d0ef57a14d1373f1f1cee2ce60ea8 Mon Sep 17 00:00:00 2001
>From: Trond Myklebust <trond.myklebust@primarydata.com>
>Date: Sat, 1 Feb 2014 14:53:23 -0500
>Subject: [PATCH] NFSv4: Fix memory corruption in nfs4_proc_open_confirm
>
>nfs41_wake_and_assign_slot() relies on the task->tk_msg.rpc_argp and
>task->tk_msg.rpc_resp always pointing to the session sequence arguments.
>
>nfs4_proc_open_confirm tries to pull a fast one by reusing the open
>sequence structure, thus causing corruption of the NFSv4 slot table.
>
>Cc: stable@vger.kernel.org # 3.12+
>Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
>---
> fs/nfs/nfs4proc.c       | 8 ++++----
> include/linux/nfs_xdr.h | 2 ++
> 2 files changed, 6 insertions(+), 4 deletions(-)
>
>diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
>index 42da6af77587..2da6a698b8f7 100644
>--- a/fs/nfs/nfs4proc.c
>+++ b/fs/nfs/nfs4proc.c
>@@ -1620,15 +1620,15 @@ static void nfs4_open_confirm_prepare(struct rpc_task *task, void *calldata)
> {
> 	struct nfs4_opendata *data = calldata;
> 
>-	nfs40_setup_sequence(data->o_arg.server, &data->o_arg.seq_args,
>-				&data->o_res.seq_res, task);
>+	nfs40_setup_sequence(data->o_arg.server, &data->c_arg.seq_args,
>+				&data->c_res.seq_res, task);
> }
> 
> static void nfs4_open_confirm_done(struct rpc_task *task, void *calldata)
> {
> 	struct nfs4_opendata *data = calldata;
> 
>-	nfs40_sequence_done(task, &data->o_res.seq_res);
>+	nfs40_sequence_done(task, &data->c_res.seq_res);
> 
> 	data->rpc_status = task->tk_status;
> 	if (data->rpc_status == 0) {
>@@ -1686,7 +1686,7 @@ static int _nfs4_proc_open_confirm(struct nfs4_opendata *data)
> 	};
> 	int status;
> 
>-	nfs4_init_sequence(&data->o_arg.seq_args, &data->o_res.seq_res, 1);
>+	nfs4_init_sequence(&data->c_arg.seq_args, &data->c_res.seq_res, 1);
> 	kref_get(&data->kref);
> 	data->rpc_done = 0;
> 	data->rpc_status = 0;
>diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
>index 3ccfcecf8999..b2fb167b2e6d 100644
>--- a/include/linux/nfs_xdr.h
>+++ b/include/linux/nfs_xdr.h
>@@ -379,12 +379,14 @@ struct nfs_openres {
>  * Arguments to the open_confirm call.
>  */
> struct nfs_open_confirmargs {
>+	struct nfs4_sequence_args	seq_args;
> 	const struct nfs_fh *	fh;
> 	nfs4_stateid *		stateid;
> 	struct nfs_seqid *	seqid;
> };
> 
> struct nfs_open_confirmres {
>+	struct nfs4_sequence_res	seq_res;
> 	nfs4_stateid            stateid;
> 	struct nfs_seqid *	seqid;
> };
>-- 
>1.8.5.3
>

Actions: View | Diff

Attachments on bug 1050206: 847339 | 858114 | 862294