linux-stable.git/include/linux/sunrpc/svc.h, branch v3.16.78

sunrpc: use-after-free in svc_process_common()

2019-03-25T17:32:32+00:00

commit d4b09acf924b84bae77cad090a9d108e70b43643 upstream.

if node have NFSv41+ mounts inside several net namespaces
it can lead to use-after-free in svc_process_common()

svc_process_common()
        /* Setup reply header */
        rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE

svc_process_common() can use incorrect rqstp->rq_xprt,
its caller function bc_svc_process() takes it from serv->sv_bc_xprt.
The problem is that serv is global structure but sv_bc_xprt
is assigned per-netnamespace.

According to Trond, the whole "let's set up rqstp->rq_xprt
for the back channel" is nothing but a giant hack in order
to work around the fact that svc_process_common() uses it
to find the xpt_ops, and perform a couple of (meaningless
for the back channel) tests of xpt_flags.

All we really need in svc_process_common() is to be able to run
rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr()

Bruce J Fields points that this xpo_prep_reply_hdr() call
is an awfully roundabout way just to do "svc_putnl(resv, 0);"
in the tcp case.

This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(),
now it calls svc_process_common() with rqstp->rq_xprt = NULL.

To adjust reply header svc_process_common() just check
rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case.

To handle rqstp->rq_xprt = NULL case in functions called from
svc_process_common() patch intruduces net namespace pointer
svc_rqst->rq_bc_net and adjust SVC_NET() definition.
Some other function was also adopted to properly handle described case.

Signed-off-by: Vasily Averin 
Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup")
Signed-off-by: J. Bruce Fields 
v2: - added lost extern svc_tcp_prep_reply_hdr()
    - context changes in svc_process_common()
    - dropped trace_svc_process() changes
Signed-off-by: Vasily Averin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

nfsd4: better reservation of head space for krb5

2014-05-30T21:32:17+00:00

RPC_MAX_AUTH_SIZE is scattered around several places.  Better to set it
once in the auth code, where this kind of estimate should be made.  And
while we're at it we can leave it zero when we're not using krb5i or
krb5p.

Signed-off-by: J. Bruce Fields

nfsd4: allow encoding across page boundaries

2014-05-30T21:31:54+00:00

After this we can handle for example getattr of very large ACLs.

Read, readdir, readlink are still special cases with their own limits.

Also we can't handle a new operation starting close to the end of a
page.

Signed-off-by: J. Bruce Fields

SUNRPC: track whether a request is coming from a loop-back interface.

2014-05-22T19:59:18+00:00

If an incoming NFS request is coming from the local host, then
nfsd will need to perform some special handling.  So detect that
possibility and make the source visible in rq_local.

Signed-off-by: NeilBrown 
Signed-off-by: J. Bruce Fields

SUNRPC/NFSD: Support a new option for ignoring the result of svc_register

2014-01-03T23:18:49+00:00

NFSv4 clients can contact port 2049 directly instead of needing the
portmapper.

Therefore a failure to register to the portmapper when starting an
NFSv4-only server isn't really a problem.

But Gareth Williams reports that an attempt to start an NFSv4-only
server without starting portmap fails:

  #rpc.nfsd -N 2 -N 3
  rpc.nfsd: writing fd to kernel failed: errno 111 (Connection refused)
  rpc.nfsd: unable to set any sockets for nfsd

Add a flag to svc_version to tell the rpc layer it can safely ignore an
rpcbind failure in the NFSv4-only case.

Reported-by: Gareth Williams 
Reviewed-by: Chuck Lever 
Signed-off-by: Kinglong Mee 
Signed-off-by: J. Bruce Fields

sunrpc: fix some typos

2013-12-11T01:37:48+00:00

Signed-off-by: Weng Meiling 
Signed-off-by: J. Bruce Fields

svcrpc: remove unused rq_resused

2013-08-30T21:43:24+00:00

I forgot to remove this in
afc59400d6c65bad66d4ad0b2daf879cbff8e23e "nfsd4: cleanup: replace
rq_resused count by rq_next_page pointer".

Signed-off-by: J. Bruce Fields

sunrpc: Fix lockd sleeping until timeout

2013-01-23T23:17:39+00:00

There is a race in enqueueing thread to a pool and
waking up a thread.
lockd doesn't wake up on reception of lock granted callback
if svc_wake_up() is called before lockd's thread is added
to a pool.

Signed-off-by: Andriy Skulysh 
Signed-off-by: J. Bruce Fields

nfsd4: cleanup: replace rq_resused count by rq_next_page pointer

2012-12-18T03:00:16+00:00

It may be a matter of personal taste, but I find this makes the code
clearer.

Signed-off-by: J. Bruce Fields

SUNRPC: service request network namespace helper introduced

2012-07-27T20:49:21+00:00

This is a cleanup patch - makes code looks simplier.
It replaces widely used rqstp->rq_xprt->xpt_net by introduced SVC_NET(rqstp).

Signed-off-by: Stanislav Kinsbursky 
Signed-off-by: J. Bruce Fields