• J. Bruce Fields's avatar
    nfsd4: avoid NULL deference on strange COPY compounds · d781e3df
    J. Bruce Fields authored
    With cross-server COPY we've introduced the possibility that the current
    or saved filehandle might not have fh_dentry/fh_export filled in, but we
    missed a place that assumed it was.  I think this could be triggered by
    a compound like:
    
    	PUTFH(foreign filehandle)
    	GETATTR
    	SAVEFH
    	COPY
    
    First, check_if_stalefh_allowed sets no_verify on the first (PUTFH) op.
    Then op_func = nfsd4_putfh runs and leaves current_fh->fh_export NULL.
    need_wrongsec_check returns true, since this PUTFH has OP_IS_PUTFH_LIKE
    set and GETATTR does not have OP_HANDLES_WRONGSEC set.
    
    We should probably also consider tightening the checks in
    check_if_stalefh_allowed and double-checking that we don't assume the
    filehandle is verified elsewhere in the compound.  But I think this
    fixes the immediate issue.
    Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
    Fixes: 4e48f1cccab3 "NFSD: allow inter server COPY to have... "
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    d781e3df
nfs4proc.c 85.8 KB