Commit f96f8cc4 authored by Trond Myklebust's avatar Trond Myklebust
Browse files

NFSv4: Sanity check the parameters in nfs41_update_target_slotid() 



Ensure that the values supplied by the server do not exceed the size of
the largest allowed slot table.

Reported-by: default avatar <rtm@csail.mit.edu>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent 1e2f67da

fs/nfs/nfs4session.c

+8 −4
Original line number Diff line number Diff line
@@ -511,12 +511,16 @@ void nfs41_update_target_slotid(struct nfs4_slot_table *tbl, 
		struct nfs4_slot *slot,

		struct nfs4_sequence_res *res)

{

	u32 target_highest_slotid = min(res->sr_target_highest_slotid,

					NFS4_MAX_SLOTID);

	u32 highest_slotid = min(res->sr_highest_slotid, NFS4_MAX_SLOTID);



	spin_lock(&tbl->slot_tbl_lock);

	if (!nfs41_is_outlier_target_slotid(tbl, res->sr_target_highest_slotid))

		nfs41_set_target_slotid_locked(tbl, res->sr_target_highest_slotid);

	if (!nfs41_is_outlier_target_slotid(tbl, target_highest_slotid))

		nfs41_set_target_slotid_locked(tbl, target_highest_slotid);

	if (tbl->generation == slot->generation)

		nfs41_set_server_slotid_locked(tbl, res->sr_highest_slotid);

	nfs41_set_max_slotid_locked(tbl, res->sr_target_highest_slotid);

		nfs41_set_server_slotid_locked(tbl, highest_slotid);

	nfs41_set_max_slotid_locked(tbl, target_highest_slotid);

	spin_unlock(&tbl->slot_tbl_lock);

}

fs/nfs/nfs4session.h

+1 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#define NFS4_DEF_SLOT_TABLE_SIZE (64U)

#define NFS4_DEF_CB_SLOT_TABLE_SIZE (16U)

#define NFS4_MAX_SLOT_TABLE (1024U)

#define NFS4_MAX_SLOTID (NFS4_MAX_SLOT_TABLE - 1U)

#define NFS4_NO_SLOT ((u32)-1)



#if IS_ENABLED(CONFIG_NFS_V4)