Received: by 2002:a05:6a10:16a7:0:0:0:0 with SMTP id gp39csp833218pxb; Tue, 3 Nov 2020 13:52:28 -0800 (PST) X-Google-Smtp-Source: ABdhPJz5AQkxzUO+w0JFJg6dOspPfgkiaJWvg/7d5GQ9w3sfMqdlRqhuhTaLmOwDzOk2beApLyJf X-Received: by 2002:a17:906:fcdb:: with SMTP id qx27mr11653771ejb.470.1604440348524; Tue, 03 Nov 2020 13:52:28 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1604440348; cv=none; d=google.com; s=arc-20160816; b=VRcfSY4emfK9kNMTi5lT8aZRDqf6CSEdBiG3pjZ1YM+UrJBjPUQ8DTA0PrPrMjHCQA s/Ey7NFaStysR1O34YdlRvXF2SqSjuvnaRxPU4FtPVvsWgAQDNkkFCaeo+QJoQ7q0aWs Ee3m3bcz3tKivz5xgcd+60c4Wad+6nW5XBDw0wU67jP/v46eMWpqji5Pi7yS4/gusP5+ lG+hdQaTAwC3HWZes04XdxYj8E7EfQok+lI5ZuUr3E3XixBvxvwZQwbD3S58y84tGGIl GvDChWshHvYp/ck3/vaA0JaD+RzPiDatGGIlhP4V+ZvWanP+WJzlMv70A5Vs6ZtmKtCu LBDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=wcFN0k4+0XiAMHYSCYM0ieMAOSWV+E1egK147KpUjUU=; b=N81isDhgTLSabZjiGlDhnPZFV5DyYoqU9MPCQu+R1/eTKAUaOqhlr7ppKGEkd49vls +WxA9yu1+BDvNfyai9SMjrZlNoWjXhitV/xn6YdPymTrsOPXNqqj7wee4wyGsFvmdVN+ V1nW8u3KAjKoN4iW3AYRvAmXNW2HFf7SsEvXNE1b3A+9HNJc0wdKeiy2xqlk+M3mORed Xdw5KdwtIMPkpBTckouUDVkRdwoQIYMVZ7D28RH1g7271fn1mgVU6M8jZ8IklI+Vy8pB 5aQKM7a28DQj84jFGJmAnFCNPCgF1E7jA7iaHoT00JewoXsWuIt8zoWA0WXUVmf9nbBC CtBg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="iV+/4KJr"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id r12si64032ejr.690.2020.11.03.13.52.05; Tue, 03 Nov 2020 13:52:28 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="iV+/4KJr"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731840AbgKCVtf (ORCPT + 99 others); Tue, 3 Nov 2020 16:49:35 -0500 Received: from mail.kernel.org ([198.145.29.99]:42704 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731583AbgKCUtf (ORCPT ); Tue, 3 Nov 2020 15:49:35 -0500 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 89988223FD; Tue, 3 Nov 2020 20:49:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604436574; bh=nKmsieHP+Q5iP8RVEYxwtSZMk69vmjd3cYIPI16zKf0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iV+/4KJrYK7I8caCXZao22v/4gD+yFB02btGRIj26xr8l9YVysQ8QfspqeroSbRKJ Ho4beU46Tn/jE43z8v3zwru7n2gt7usSvAZ8KLgTs1T0QC7rtgsRNoQouKBSCbf/iV 7MWztBuZ4ZcUBtwpIVQhwc9c7CjN4kE+21t8EQsw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chuck Lever , "J. Bruce Fields" Subject: [PATCH 5.9 302/391] NFSD: Add missing NFSv2 .pc_func methods Date: Tue, 3 Nov 2020 21:35:53 +0100 Message-Id: <20201103203407.465667369@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201103203348.153465465@linuxfoundation.org> References: <20201103203348.153465465@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Chuck Lever commit 6b3dccd48de8a4c650b01499a0b09d1e2279649e upstream. There's no protection in nfsd_dispatch() against a NULL .pc_func helpers. A malicious NFS client can trigger a crash by invoking the unused/unsupported NFSv2 ROOT or WRITECACHE procedures. The current NFSD dispatcher does not support returning a void reply to a non-NULL procedure, so the reply to both of these is wrong, for the moment. Cc: Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman --- fs/nfsd/nfsproc.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) --- a/fs/nfsd/nfsproc.c +++ b/fs/nfsd/nfsproc.c @@ -118,6 +118,13 @@ done: return nfsd_return_attrs(nfserr, resp); } +/* Obsolete, replaced by MNTPROC_MNT. */ +static __be32 +nfsd_proc_root(struct svc_rqst *rqstp) +{ + return nfs_ok; +} + /* * Look up a path name component * Note: the dentry in the resp->fh may be negative if the file @@ -203,6 +210,13 @@ nfsd_proc_read(struct svc_rqst *rqstp) return fh_getattr(&resp->fh, &resp->stat); } +/* Reserved */ +static __be32 +nfsd_proc_writecache(struct svc_rqst *rqstp) +{ + return nfs_ok; +} + /* * Write data to a file * N.B. After this call resp->fh needs an fh_put @@ -617,6 +631,7 @@ static const struct svc_procedure nfsd_p .pc_xdrressize = ST+AT, }, [NFSPROC_ROOT] = { + .pc_func = nfsd_proc_root, .pc_decode = nfssvc_decode_void, .pc_encode = nfssvc_encode_void, .pc_argsize = sizeof(struct nfsd_void), @@ -654,6 +669,7 @@ static const struct svc_procedure nfsd_p .pc_xdrressize = ST+AT+1+NFSSVC_MAXBLKSIZE_V2/4, }, [NFSPROC_WRITECACHE] = { + .pc_func = nfsd_proc_writecache, .pc_decode = nfssvc_decode_void, .pc_encode = nfssvc_encode_void, .pc_argsize = sizeof(struct nfsd_void),