Commit 241b1f41 authored by Chuck Lever's avatar Chuck Lever Committed by Anna Schumaker
Browse files

SUNRPC: Remove xdr_buf_trim() 



The key action of xdr_buf_trim() is that it shortens buf->len, the
length of the xdr_buf's content. The other actions -- shortening the
head, pages, and tail components -- are actually not necessary. In
particular, changing the size of those components can corrupt the
RPC message contained in the buffer. This is an accident waiting to
happen rather than a current bug, as far as we know.

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Acked-by: default avatarBruce Fields <bfields@redhat.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent 0c77668d

include/linux/sunrpc/xdr.h

+0 −1
Original line number Diff line number Diff line
@@ -179,7 +179,6 @@ xdr_adjust_iovec(struct kvec *iov, __be32 *p) 
extern void xdr_shift_buf(struct xdr_buf *, size_t);

extern void xdr_buf_from_iov(struct kvec *, struct xdr_buf *);

extern int xdr_buf_subsegment(struct xdr_buf *, struct xdr_buf *, unsigned int, unsigned int);

extern void xdr_buf_trim(struct xdr_buf *, unsigned int);

extern int xdr_buf_read_netobj(struct xdr_buf *, struct xdr_netobj *, unsigned int);

extern int read_bytes_from_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);

extern int write_bytes_to_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);

net/sunrpc/auth_gss/gss_krb5_wrap.c

+5 −3
Original line number Diff line number Diff line
@@ -570,14 +570,16 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf) 
	 */

	movelen = min_t(unsigned int, buf->head[0].iov_len, buf->len);

	movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;

	BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >

							buf->head[0].iov_len);

	if (offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >

	    buf->head[0].iov_len)

		return GSS_S_FAILURE;

	memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen);

	buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;

	buf->len -= GSS_KRB5_TOK_HDR_LEN + headskip;



	/* Trim off the trailing "extra count" and checksum blob */

	xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);

	buf->len -= ec + GSS_KRB5_TOK_HDR_LEN + tailskip;



	return GSS_S_COMPLETE;

}

net/sunrpc/auth_gss/svcauth_gss.c

+1 −1
Original line number Diff line number Diff line
@@ -896,7 +896,7 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g 
	if (svc_getnl(&buf->head[0]) != seq)

		goto out;

	/* trim off the mic and padding at the end before returning */

	xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);

	buf->len -= 4 + round_up_to_quad(mic.len);

	stat = 0;

out:

	kfree(mic.data);

net/sunrpc/xdr.c

+0 −41
Original line number Diff line number Diff line
@@ -1139,47 +1139,6 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, 
}

EXPORT_SYMBOL_GPL(xdr_buf_subsegment);



/**

 * xdr_buf_trim - lop at most "len" bytes off the end of "buf"

 * @buf: buf to be trimmed

 * @len: number of bytes to reduce "buf" by

 *

 * Trim an xdr_buf by the given number of bytes by fixing up the lengths. Note

 * that it's possible that we'll trim less than that amount if the xdr_buf is

 * too small, or if (for instance) it's all in the head and the parser has

 * already read too far into it.

 */

void xdr_buf_trim(struct xdr_buf *buf, unsigned int len)

{

	size_t cur;

	unsigned int trim = len;



	if (buf->tail[0].iov_len) {

		cur = min_t(size_t, buf->tail[0].iov_len, trim);

		buf->tail[0].iov_len -= cur;

		trim -= cur;

		if (!trim)

			goto fix_len;

	}



	if (buf->page_len) {

		cur = min_t(unsigned int, buf->page_len, trim);

		buf->page_len -= cur;

		trim -= cur;

		if (!trim)

			goto fix_len;

	}



	if (buf->head[0].iov_len) {

		cur = min_t(size_t, buf->head[0].iov_len, trim);

		buf->head[0].iov_len -= cur;

		trim -= cur;

	}

fix_len:

	buf->len -= (len - trim);

}

EXPORT_SYMBOL_GPL(xdr_buf_trim);



static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len)

{

	unsigned int this_len;

CRA Git | Maintained and supported by SUSTech CRA and CCSE