From patchwork Sat Jul 2 09:01:44 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mi Jinlong X-Patchwork-Id: 940272 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.4) with ESMTP id p628weFu025134 for ; Sat, 2 Jul 2011 08:58:40 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752705Ab1GBI6h (ORCPT ); Sat, 2 Jul 2011 04:58:37 -0400 Received: from cn.fujitsu.com ([222.73.24.84]:50637 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1752661Ab1GBI6h (ORCPT ); Sat, 2 Jul 2011 04:58:37 -0400 Received: from tang.cn.fujitsu.com (tang.cn.fujitsu.com [10.167.250.3]) by song.cn.fujitsu.com (Postfix) with ESMTP id E0A8E170091; Sat, 2 Jul 2011 16:58:32 +0800 (CST) Received: from mailserver.fnst.cn.fujitsu.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id p628wW6u002321; Sat, 2 Jul 2011 16:58:32 +0800 Received: from [127.0.0.1] ([10.167.225.24]) by mailserver.fnst.cn.fujitsu.com (Lotus Domino Release 8.5.1FP4) with ESMTP id 2011070216575907-729283 ; Sat, 2 Jul 2011 16:57:59 +0800 Message-ID: <4E0EDE78.1060208@cn.fujitsu.com> Date: Sat, 02 Jul 2011 17:01:44 +0800 From: Mi Jinlong User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: "J. Bruce Fields" CC: NFS Subject: [PATCH 1/2 v2] nfsd41: error out when client sets maxreq_sz or, maxresp_sz too small X-MIMETrack: Itemize by SMTP Server on mailserver/fnst(Release 8.5.1FP4|July 25, 2010) at 2011-07-02 16:57:59, Serialize by Router on mailserver/fnst(Release 8.5.1FP4|July 25, 2010) at 2011-07-02 16:57:59, Serialize complete at 2011-07-02 16:57:59 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Sat, 02 Jul 2011 08:58:40 +0000 (UTC) According to RFC5661, 18.36.3, "if the client selects a value for ca_maxresponsesize such that a replier on a channel could never send a response,the server SHOULD return NFS4ERR_TOOSMALL in the CREATE_SESSION reply." This patch let server error out when client sets maxreq_sz less than SEQUENCE request size, and maxresp_sz less than a SEQUENCE reply size. Signed-off-by: Mi Jinlong --- fs/nfsd/nfs4xdr.c | 26 +++++++++++++++++++++++++- 1 files changed, 25 insertions(+), 1 deletions(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index 9901811..bece272 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -1135,11 +1135,25 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp, { DECODE_HEAD; - u32 dummy; + struct xdr_buf *xb = &argp->rqstp->rq_arg; + u32 dummy, minreqlen = 0, minresplen = 0; char *machine_name; int i; int nr_secflavs; + /* RPC header length and tag, minorversion, Opt count*/ + minreqlen = (char *)argp->p - ((char *)argp->end - xb->len); + /* length with a SEQUENCE operation */ + minreqlen = minreqlen + sizeof(struct nfs4_sessionid) + + 4 * sizeof(__be32); + + /* RPC header, status, tag len */ + minresplen = argp->rqstp->rq_res.head[0].iov_len + 2 * sizeof(__be32) + /* tag, opt count, opcode, op status */ + + ALIGN(argp->taglen, 4) + 3 * sizeof(__be32) + /* sessionid, seqid, 3 * slotid, status*/ + + sizeof(struct nfs4_sessionid) + 5 * sizeof(__be32); + READ_BUF(16); COPYMEM(&sess->clientid, 8); READ32(sess->seqid); @@ -1149,7 +1163,17 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp, READ_BUF(28); READ32(dummy); /* headerpadsz is always 0 */ READ32(sess->fore_channel.maxreq_sz); + if (sess->fore_channel.maxreq_sz < minreqlen) { + status = nfserr_toosmall; + goto out; + } + READ32(sess->fore_channel.maxresp_sz); + if (sess->fore_channel.maxresp_sz < minresplen) { + status = nfserr_toosmall; + goto out; + } + READ32(sess->fore_channel.maxresp_cached); READ32(sess->fore_channel.maxops); READ32(sess->fore_channel.maxreqs);