Messages in this thread |  | | | From | (Alan Cox) | | Subject | Re: problems with nfsd dentry validation | | Date | Sun, 17 Aug 1997 18:13:21 +0100 (BST) |
| |
> (1) Server has valid dentry and has bumped the use count so it can't > disappear locally. Client modifies packet to install a bogus dentry > pointer. Server calls d_validate, finds that the dentry doesn't exist > and returns error. But the dentry count has now leaked -- I don't see > how the server can do an eventual dput() to release the original dentry.
It should get timed out - NFS has no "close" functionality.
> previously good one. Server calls d_validate, and sometimes the > inserted pointer is still valid. Server processes call, but there's now > an extra reference to a dentry. Eventual dput() corrupts the dentry > tree. > > Also, there's a problem with the fh_copy routine, which can add a > reference to a dentry. (i.e. if dvalidate is set, doing a fh_copy adds > a reference to the dentry without doing a dget().)
The easiest approach to this is probably to use the MDx routines in the kernel to secure hash a combination of the dentry and a randomly created kernel secret chosen at boot time and the client IP address. It takes very few clocks to verify these.
Alan
|  |