Commit bcd89270 authored by Marc Dionne's avatar Marc Dionne Committed by David Howells
Browse files

afs: Deal with an empty callback array 



Servers may send a callback array that is the same size as
the FID array, or an empty array.  If the callback count is
0, the code would attempt to read (fid_count * 12) bytes of
data, which would fail and result in an unmarshalling error.
This would lead to stale data for remotely modified files
or directories.

Store the callback array size in the internal afs_call
structure and use that to determine the amount of data to
read.

Signed-off-by: default avatarMarc Dionne <marc.dionne@auristor.com>
parent 627f4694

fs/afs/cmservice.c

+5 −6
Original line number Diff line number Diff line
@@ -187,7 +187,6 @@ static int afs_deliver_cb_callback(struct afs_call *call) 
	struct afs_callback *cb;

	struct afs_server *server;

	__be32 *bp;

	u32 tmp;

	int ret, loop;



	_enter("{%u}", call->unmarshall);
@@ -249,9 +248,9 @@ static int afs_deliver_cb_callback(struct afs_call *call) 
		if (ret < 0)

			return ret;



		tmp = ntohl(call->tmp);

		_debug("CB count: %u", tmp);

		if (tmp != call->count && tmp != 0)

		call->count2 = ntohl(call->tmp);

		_debug("CB count: %u", call->count2);

		if (call->count2 != call->count && call->count2 != 0)

			return -EBADMSG;

		call->offset = 0;

		call->unmarshall++;
@@ -259,14 +258,14 @@ static int afs_deliver_cb_callback(struct afs_call *call) 
	case 4:

		_debug("extract CB array");

		ret = afs_extract_data(call, call->buffer,

				       call->count * 3 * 4, false);

				       call->count2 * 3 * 4, false);

		if (ret < 0)

			return ret;



		_debug("unmarshall CB array");

		cb = call->request;

		bp = call->buffer;

		for (loop = call->count; loop > 0; loop--, cb++) {

		for (loop = call->count2; loop > 0; loop--, cb++) {

			cb->version	= ntohl(*bp++);

			cb->expiry	= ntohl(*bp++);

			cb->type	= ntohl(*bp++);

fs/afs/internal.h

+4 −1
Original line number Diff line number Diff line
@@ -90,7 +90,10 @@ struct afs_call { 
	unsigned		request_size;	/* size of request data */

	unsigned		reply_max;	/* maximum size of reply */

	unsigned		first_offset;	/* offset into mapping[first] */

	union {

		unsigned	last_to;	/* amount of mapping[last] */

		unsigned	count2;		/* count used in unmarshalling */

	};

	unsigned char		unmarshall;	/* unmarshalling phase */

	bool			incoming;	/* T if incoming call */

	bool			send_pages;	/* T if data from mapping should be sent */

CRA Git | Maintained and supported by SUSTech CRA and CCSE