Commit f7d3e54f authored by Trond Myklebust's avatar Trond Myklebust Committed by Greg Kroah-Hartman

NFSv4: Fix EXCHANGE_ID corrupt verifier issue

commit fd40559c upstream.

The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was
changed to be asynchronous by commit 8d89bd70. If we interrrupt
the call to rpc_wait_for_completion_task(), we can therefore end up
transmitting random stack contents in lieu of the verifier.

Fixes: 8d89bd70 ("NFS setup async exchange_id")
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f5214eb4
...@@ -7410,7 +7410,7 @@ static void nfs4_exchange_id_done(struct rpc_task *task, void *data) ...@@ -7410,7 +7410,7 @@ static void nfs4_exchange_id_done(struct rpc_task *task, void *data)
cdata->res.server_scope = NULL; cdata->res.server_scope = NULL;
} }
/* Save the EXCHANGE_ID verifier session trunk tests */ /* Save the EXCHANGE_ID verifier session trunk tests */
memcpy(clp->cl_confirm.data, cdata->args.verifier->data, memcpy(clp->cl_confirm.data, cdata->args.verifier.data,
sizeof(clp->cl_confirm.data)); sizeof(clp->cl_confirm.data));
} }
out: out:
...@@ -7447,7 +7447,6 @@ static const struct rpc_call_ops nfs4_exchange_id_call_ops = { ...@@ -7447,7 +7447,6 @@ static const struct rpc_call_ops nfs4_exchange_id_call_ops = {
static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred, static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
u32 sp4_how, struct rpc_xprt *xprt) u32 sp4_how, struct rpc_xprt *xprt)
{ {
nfs4_verifier verifier;
struct rpc_message msg = { struct rpc_message msg = {
.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_EXCHANGE_ID], .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_EXCHANGE_ID],
.rpc_cred = cred, .rpc_cred = cred,
...@@ -7470,8 +7469,7 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred, ...@@ -7470,8 +7469,7 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
if (!calldata) if (!calldata)
goto out; goto out;
if (!xprt) nfs4_init_boot_verifier(clp, &calldata->args.verifier);
nfs4_init_boot_verifier(clp, &verifier);
status = nfs4_init_uniform_client_string(clp); status = nfs4_init_uniform_client_string(clp);
if (status) if (status)
...@@ -7516,9 +7514,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred, ...@@ -7516,9 +7514,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
task_setup_data.rpc_xprt = xprt; task_setup_data.rpc_xprt = xprt;
task_setup_data.flags = task_setup_data.flags =
RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC; RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;
calldata->args.verifier = &clp->cl_confirm; memcpy(calldata->args.verifier.data, clp->cl_confirm.data,
} else { sizeof(calldata->args.verifier.data));
calldata->args.verifier = &verifier;
} }
calldata->args.client = clp; calldata->args.client = clp;
#ifdef CONFIG_NFS_V4_1_MIGRATION #ifdef CONFIG_NFS_V4_1_MIGRATION
......
...@@ -1761,7 +1761,7 @@ static void encode_exchange_id(struct xdr_stream *xdr, ...@@ -1761,7 +1761,7 @@ static void encode_exchange_id(struct xdr_stream *xdr,
int len = 0; int len = 0;
encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr); encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);
encode_nfs4_verifier(xdr, args->verifier); encode_nfs4_verifier(xdr, &args->verifier);
encode_string(xdr, strlen(args->client->cl_owner_id), encode_string(xdr, strlen(args->client->cl_owner_id),
args->client->cl_owner_id); args->client->cl_owner_id);
......
...@@ -1199,7 +1199,7 @@ struct nfs41_state_protection { ...@@ -1199,7 +1199,7 @@ struct nfs41_state_protection {
struct nfs41_exchange_id_args { struct nfs41_exchange_id_args {
struct nfs_client *client; struct nfs_client *client;
nfs4_verifier *verifier; nfs4_verifier verifier;
u32 flags; u32 flags;
struct nfs41_state_protection state_protect; struct nfs41_state_protection state_protect;
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment