lkml.org 
[lkml]   [1997]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From(Alan Cox)
SubjectRe: problems with nfsd dentry validation
DateSun, 17 Aug 1997 18:13:21 +0100 (BST)
> (1) Server has valid dentry and has bumped the use count so it can't
> disappear locally. Client modifies packet to install a bogus dentry
> pointer. Server calls d_validate, finds that the dentry doesn't exist
> and returns error. But the dentry count has now leaked -- I don't see
> how the server can do an eventual dput() to release the original dentry.

It should get timed out - NFS has no "close" functionality.

> previously good one. Server calls d_validate, and sometimes the
> inserted pointer is still valid. Server processes call, but there's now
> an extra reference to a dentry. Eventual dput() corrupts the dentry
> tree.
>
> Also, there's a problem with the fh_copy routine, which can add a
> reference to a dentry. (i.e. if dvalidate is set, doing a fh_copy adds
> a reference to the dentry without doing a dget().)

The easiest approach to this is probably to use the MDx routines in the
kernel to secure hash a combination of the dentry and a randomly created
kernel secret chosen at boot time and the client IP address. It takes
very few clocks to verify these.

Alan

\
 
 \ /
  Last update: 2005-03-22 13:40    [from the cache]
©2003-2010