Selaa lähdekoodia

NFSv4.1: Make sure nfsd can decode SP4_SSV correctly at exchange_id

According to RFC, the argument of ssv_sp_parms4 is:

   struct ssv_sp_parms4 {
           state_protect_ops4      ssp_ops;
           sec_oid4                ssp_hash_algs<>;
           sec_oid4                ssp_encr_algs<>;
           uint32_t                ssp_window;
           uint32_t                ssp_num_gss_handles;
   };

If client send a exchange_id with SP4_SSV, server cann't decode
the SP4_SSV's ssp_hash_algs and ssp_encr_algs arguments correctly.

Because the kernel treat the two arguments as a signal
sec_oid4 struct, but should be a set of sec_oid4 struct.

Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Mi Jinlong 14 vuotta sitten
vanhempi
commit
5afa040b30
1 muutettua tiedostoa jossa 15 lisäystä ja 7 poistoa
  1. 15 7
      fs/nfsd/nfs4xdr.c

+ 15 - 7
fs/nfsd/nfs4xdr.c

@@ -1005,7 +1005,7 @@ static __be32
 nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
 nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
 			 struct nfsd4_exchange_id *exid)
 			 struct nfsd4_exchange_id *exid)
 {
 {
-	int dummy;
+	int dummy, tmp;
 	DECODE_HEAD;
 	DECODE_HEAD;
 
 
 	READ_BUF(NFS4_VERIFIER_SIZE);
 	READ_BUF(NFS4_VERIFIER_SIZE);
@@ -1053,15 +1053,23 @@ nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
 
 
 		/* ssp_hash_algs<> */
 		/* ssp_hash_algs<> */
 		READ_BUF(4);
 		READ_BUF(4);
-		READ32(dummy);
-		READ_BUF(dummy);
-		p += XDR_QUADLEN(dummy);
+		READ32(tmp);
+		while (tmp--) {
+			READ_BUF(4);
+			READ32(dummy);
+			READ_BUF(dummy);
+			p += XDR_QUADLEN(dummy);
+		}
 
 
 		/* ssp_encr_algs<> */
 		/* ssp_encr_algs<> */
 		READ_BUF(4);
 		READ_BUF(4);
-		READ32(dummy);
-		READ_BUF(dummy);
-		p += XDR_QUADLEN(dummy);
+		READ32(tmp);
+		while (tmp--) {
+			READ_BUF(4);
+			READ32(dummy);
+			READ_BUF(dummy);
+			p += XDR_QUADLEN(dummy);
+		}
 
 
 		/* ssp_window and ssp_num_gss_handles */
 		/* ssp_window and ssp_num_gss_handles */
 		READ_BUF(8);
 		READ_BUF(8);