lkml.org 
[lkml]   [2013]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 075/103] svcrpc: fix handling of too-short rpcs
    Date
    3.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "J. Bruce Fields" <bfields@redhat.com>

    commit cf3aa02cb4a0c5af5557dd47f15a08a7df33182a upstream.

    If we detect that an rpc is too short, we abort and close the
    connection. Except, there's a bug here: we're leaving sk_datalen
    nonzero without leaving any pages in the sk_pages array. The most
    likely result of the inconsistency is a subsequent crash in
    svc_tcp_clear_pages.

    Also demote the BUG_ON in svc_tcp_clear_pages to a WARN.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/sunrpc/svcsock.c | 9 +++++++--
    1 file changed, 7 insertions(+), 2 deletions(-)

    --- a/net/sunrpc/svcsock.c
    +++ b/net/sunrpc/svcsock.c
    @@ -917,7 +917,10 @@ static void svc_tcp_clear_pages(struct s
    len = svsk->sk_datalen;
    npages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
    for (i = 0; i < npages; i++) {
    - BUG_ON(svsk->sk_pages[i] == NULL);
    + if (svsk->sk_pages[i] == NULL) {
    + WARN_ON_ONCE(1);
    + continue;
    + }
    put_page(svsk->sk_pages[i]);
    svsk->sk_pages[i] = NULL;
    }
    @@ -1092,8 +1095,10 @@ static int svc_tcp_recvfrom(struct svc_r
    goto err_noclose;
    }

    - if (svc_sock_reclen(svsk) < 8)
    + if (svc_sock_reclen(svsk) < 8) {
    + svsk->sk_datalen = 0;
    goto err_delete; /* client is nuts. */
    + }

    rqstp->rq_arg.len = svsk->sk_datalen;
    rqstp->rq_arg.page_base = 0;



    \
     
     \ /
      Last update: 2013-07-24 02:41    [W:4.220 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site