Commit fd40559c authored by Trond Myklebust's avatar Trond Myklebust Committed by Anna Schumaker
Browse files

NFSv4: Fix EXCHANGE_ID corrupt verifier issue 



The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was
changed to be asynchronous by commit 8d89bd70. If we interrrupt
the call to rpc_wait_for_completion_task(), we can therefore end up
transmitting random stack contents in lieu of the verifier.

Fixes: 8d89bd70 ("NFS setup async exchange_id")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent b7dbcc0e

fs/nfs/nfs4proc.c

+4 −7
Original line number Diff line number Diff line
@@ -7460,7 +7460,7 @@ static void nfs4_exchange_id_done(struct rpc_task *task, void *data) 
			cdata->res.server_scope = NULL;

		}

		/* Save the EXCHANGE_ID verifier session trunk tests */

		memcpy(clp->cl_confirm.data, cdata->args.verifier->data,

		memcpy(clp->cl_confirm.data, cdata->args.verifier.data,

		       sizeof(clp->cl_confirm.data));

	}

out:
@@ -7497,7 +7497,6 @@ static const struct rpc_call_ops nfs4_exchange_id_call_ops = { 
static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,

			u32 sp4_how, struct rpc_xprt *xprt)

{

	nfs4_verifier verifier;

	struct rpc_message msg = {

		.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_EXCHANGE_ID],

		.rpc_cred = cred,
@@ -7521,8 +7520,7 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred, 
		return -ENOMEM;

	}



	if (!xprt)

		nfs4_init_boot_verifier(clp, &verifier);

	nfs4_init_boot_verifier(clp, &calldata->args.verifier);



	status = nfs4_init_uniform_client_string(clp);

	if (status)
@@ -7563,9 +7561,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred, 
		task_setup_data.rpc_xprt = xprt;

		task_setup_data.flags =

				RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;

		calldata->args.verifier = &clp->cl_confirm;

	} else {

		calldata->args.verifier = &verifier;

		memcpy(calldata->args.verifier.data, clp->cl_confirm.data,

				sizeof(calldata->args.verifier.data));

	}

	calldata->args.client = clp;

#ifdef CONFIG_NFS_V4_1_MIGRATION

fs/nfs/nfs4xdr.c

+1 −1
Original line number Diff line number Diff line
@@ -1785,7 +1785,7 @@ static void encode_exchange_id(struct xdr_stream *xdr, 
	int len = 0;



	encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);

	encode_nfs4_verifier(xdr, args->verifier);

	encode_nfs4_verifier(xdr, &args->verifier);



	encode_string(xdr, strlen(args->client->cl_owner_id),

			args->client->cl_owner_id);

include/linux/nfs_xdr.h

+1 −1
Original line number Diff line number Diff line
@@ -1235,7 +1235,7 @@ struct nfs41_state_protection { 


struct nfs41_exchange_id_args {

	struct nfs_client		*client;

	nfs4_verifier			*verifier;

	nfs4_verifier			verifier;

	u32				flags;

	struct nfs41_state_protection	state_protect;

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE