leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

NFS: Fix an Oops in encode_lookup()

Browse Source 
It doesn't look as if the NFS file name limit is being initialised correctly
in the struct nfs_server. Make sure that we limit whatever is being set in
nfs_probe_fsinfo() and nfs_init_server().

Also ensure that readdirplus and nfs4_path_walk respect our file name
limits.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Trond Myklebust 2007-09-28 12:27:41 -04:00 committed by Linus Torvalds
parent bd89366324
commit 54af3bb543
3 changed files with 24 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
fs/nfs/client.c
View File

@ -588,16 +588,6 @@ static int nfs_init_server(struct nfs_server *server, const struct nfs_mount_dat
server->namelen = data->namlen; server->namelen = data->namlen;
/* Create a client RPC handle for the NFSv3 ACL management interface */ /* Create a client RPC handle for the NFSv3 ACL management interface */
nfs_init_server_aclclient(server); nfs_init_server_aclclient(server);
if (clp->cl_nfsversion == 3) {
if (server->namelen == 0 || server->namelen > NFS3_MAXNAMLEN)
server->namelen = NFS3_MAXNAMLEN;
if (!(data->flags & NFS_MOUNT_NORDIRPLUS))
server->caps |= NFS_CAP_READDIRPLUS;
} else {
if (server->namelen == 0 || server->namelen > NFS2_MAXNAMLEN)
server->namelen = NFS2_MAXNAMLEN;
}
dprintk("<-- nfs_init_server() = 0 [new %p]\n", clp); dprintk("<-- nfs_init_server() = 0 [new %p]\n", clp);
return 0; return 0;
@ -794,6 +784,16 @@ struct nfs_server *nfs_create_server(const struct nfs_mount_data *data,
error = nfs_probe_fsinfo(server, mntfh, &fattr); error = nfs_probe_fsinfo(server, mntfh, &fattr);
if (error < 0) if (error < 0)
goto error; goto error;
if (server->nfs_client->rpc_ops->version == 3) {
if (server->namelen == 0 || server->namelen > NFS3_MAXNAMLEN)
server->namelen = NFS3_MAXNAMLEN;
if (!(data->flags & NFS_MOUNT_NORDIRPLUS))
server->caps |= NFS_CAP_READDIRPLUS;
} else {
if (server->namelen == 0 || server->namelen > NFS2_MAXNAMLEN)
server->namelen = NFS2_MAXNAMLEN;
}
if (!(fattr.valid & NFS_ATTR_FATTR)) { if (!(fattr.valid & NFS_ATTR_FATTR)) {
error = server->nfs_client->rpc_ops->getattr(server, mntfh, &fattr); error = server->nfs_client->rpc_ops->getattr(server, mntfh, &fattr);
if (error < 0) { if (error < 0) {
@ -984,6 +984,9 @@ struct nfs_server *nfs4_create_server(const struct nfs4_mount_data *data,
if (error < 0) if (error < 0)
goto error; goto error;
if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
server->namelen = NFS4_MAXNAMLEN;
BUG_ON(!server->nfs_client); BUG_ON(!server->nfs_client);
BUG_ON(!server->nfs_client->rpc_ops); BUG_ON(!server->nfs_client->rpc_ops);
BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops); BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
@ -1056,6 +1059,9 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
if (error < 0) if (error < 0)
goto error; goto error;
if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
server->namelen = NFS4_MAXNAMLEN;
dprintk("Referral FSID: %llx:%llx\n", dprintk("Referral FSID: %llx:%llx\n",
(unsigned long long) server->fsid.major, (unsigned long long) server->fsid.major,
(unsigned long long) server->fsid.minor); (unsigned long long) server->fsid.minor);
@ -1115,6 +1121,9 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
if (error < 0) if (error < 0)
goto out_free_server; goto out_free_server;
if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
server->namelen = NFS4_MAXNAMLEN;
dprintk("Cloned FSID: %llx:%llx\n", dprintk("Cloned FSID: %llx:%llx\n",
(unsigned long long) server->fsid.major, (unsigned long long) server->fsid.major,
(unsigned long long) server->fsid.minor); (unsigned long long) server->fsid.minor);

2
fs/nfs/dir.c
View File

@ -1162,6 +1162,8 @@ static struct dentry *nfs_readdir_lookup(nfs_readdir_descriptor_t *desc)
} }
if (!desc->plus || !(entry->fattr->valid & NFS_ATTR_FATTR)) if (!desc->plus || !(entry->fattr->valid & NFS_ATTR_FATTR))
return NULL; return NULL;
if (name.len > NFS_SERVER(dir)->namelen)
return NULL;
/* Note: caller is already holding the dir->i_mutex! */ /* Note: caller is already holding the dir->i_mutex! */
dentry = d_alloc(parent, &name); dentry = d_alloc(parent, &name);
if (dentry == NULL) if (dentry == NULL)

3
fs/nfs/getroot.c
View File

@ -175,6 +175,9 @@ next_component:
path++; path++;
name.len = path - (const char *) name.name; name.len = path - (const char *) name.name;
if (name.len > NFS4_MAXNAMLEN)
return -ENAMETOOLONG;
eat_dot_dir: eat_dot_dir:
while (*path == '/') while (*path == '/')
path++; path++;