From patchwork Wed Oct 22 19:49:08 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "J. Bruce Fields" X-Patchwork-Id: 5136741 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id DF3C5C11AC for ; Wed, 22 Oct 2014 19:49:16 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4914920256 for ; Wed, 22 Oct 2014 19:49:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7246020222 for ; Wed, 22 Oct 2014 19:49:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932388AbaJVTtN (ORCPT ); Wed, 22 Oct 2014 15:49:13 -0400 Received: from fieldses.org ([174.143.236.118]:45838 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932071AbaJVTtM (ORCPT ); Wed, 22 Oct 2014 15:49:12 -0400 Received: from bfields by fieldses.org with local (Exim 4.76) (envelope-from ) id 1Xh1u8-0001jk-1s; Wed, 22 Oct 2014 15:49:08 -0400 Date: Wed, 22 Oct 2014 15:49:08 -0400 From: "J. Bruce Fields" To: Anna Schumaker , Trond Myklebust Cc: linux-nfs@vger.kernel.org, Chuck Lever , Christoph Hellwig Subject: [PATCH] nfsd4: fix crash on unknown operation number Message-ID: <20141022194907.GD5552@fieldses.org> References: <20141017212446.GC3474@fieldses.org> <20141021103631.GB21863@infradead.org> <20141021131406.GE9863@fieldses.org> <20141022192258.GB5552@fieldses.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20141022192258.GB5552@fieldses.org> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: "J. Bruce Fields" Unknown operation numbers are caught in nfsd4_decode_compound() which sets op->opnum to OP_ILLEGAL and op->status to nfserr_op_illegal. The error causes the main loop in nfsd4_proc_compound() to skip most processing. But nfsd4_proc_compound also peeks ahead at the next operation in one case and doesn't take similar precautions there. Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields --- fs/nfsd/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) On Wed, Oct 22, 2014 at 03:2 > There are two bugs: > > - the client is sending SEEK over minorversion 1. > - this sometimes causes the server to crash. > > I'm testing a fix for the latter. I think this is all it needs. diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index f4bd578bed55..0beb023f25ac 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1272,7 +1272,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp) */ if (argp->opcnt == resp->opcnt) return false; - + if (next->opnum == OP_ILLEGAL) + return false; nextd = OPDESC(next); /* * Rest of 2.6.3.1.1: certain operations will return WRONGSEC