kernel.git/fs/nfsd, branch linux-2.6.19.y

[PATCH] Fix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)

2007-02-20T06:30:55Z

Due to type confusion, when an nfsacl verison 2 'ACCESS' request finishes and tries to clean up, it calls fh_put on entiredly the wrong thing and this can cause an oops. Signed-off-by: Neil Brown Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

[PATCH] knfsd: fix up some bit-rot in exp_export

2007-02-05T16:31:43Z

The nfsservctl systemcall isn't used but recent nfs-utils releases for exporting filesystems, and consequently the code that is uses - exp_export - has suffered some bitrot. Particular: - some newly added fields in 'struct svc_export' are being initialised properly. - the return value is now always -ENOMEM ... This patch fixes both these problems. Signed-off-by: Neil Brown Signed-off-by: Chris Wright

[PATCH] knfsd: fix type mismatch with filldir_t used by nfsd.

2007-02-05T16:31:43Z

nfsd defines a type 'encode_dent_fn' which is much like 'filldir_t' except that the first pointer is 'struct readdir_cd *' rather than 'void *'. It then casts encode_dent_fn points to 'filldir_t' as needed. This hides any other type mismatches between the two such as the fact that the 'ino' arg recently changed from ino_t to u64. So: get rid of 'encode_dent_fn', get rid of the cast of the function type, change the first arg of various functions from 'struct readdir_cd *' to 'void *', and live with the fact that we have a little less type checking on the calling of these functions now. Less internal (to nfsd) checking offset by more external checking, which is more important. Thanks to Gabriel Paubert for discovering this and providing an initial patch. Signed-off-by: Gabriel Paubert Signed-off-by: Neil Brown Signed-off-by: Chris Wright

[PATCH] knfsd: fix an NFSD bug with full sized, non-page-aligned reads.

2007-02-05T16:31:43Z

NFSd assumes that largest number of pages that will be needed for a request+response is 2+N where N pages is the size of the largest permitted read/write request. The '2' are 1 for the non-data part of the request, and 1 for the non-data part of the reply. However, when a read request is not page-aligned, and we choose to use ->sendfile to send it directly from the page cache, we may need N+1 pages to hold the whole reply. This can overflow and array and cause an Oops. This patch increases size of the array for holding pages by one and makes sure that entry is NULL when it is not in use. Signed-off-by: Neil Brown Signed-off-by: Chris Wright

[PATCH] knfsd: fix setting of ACL server versions.

2007-02-05T16:31:43Z

Due to silly typos, if the nfs versions are explicitly set, no NFSACL versions get enabled. Also improve an error message that would have made this bug a little easier to find. Signed-off-by: Neil Brown Signed-off-by: Chris Wright

[PATCH] nfsd: fix spurious error return from nfsd_create in async case

2006-11-09T02:29:25Z

Commit 6264d69d7df654ca64f625e9409189a0e50734e9 modified the nfsd_create() error handling in such a way that nfsd_create will usually return nfserr_perm even when succesful, if the export has the async export option. This introduced a regression that could cause mkdir() to always return a permissions error, even though the directory in question was actually succesfully created. Signed-off-by: J. Bruce Fields Acked-by: NeilBrown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] nfsd4: fix open-create permissions

2006-11-09T02:29:23Z

In the case where an open creates the file, we shouldn't be rechecking permissions to open the file; the open succeeds regardless of what the new file's mode bits say. This patch fixes the problem, but only by introducing yet another parameter to nfsd_create_v3. This is ugly. This will be fixed by later patches. Signed-off-by: J. Bruce Fields Acked-by: Neil Brown Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] nfsd4: reindent do_open_lookup()

2006-11-09T02:29:22Z

Minor rearrangement, cleanup of do_open_lookup(). No change in behavior. Signed-off-by: J. Bruce Fields Acked-by: Neil Brown Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] NFS4: fix for recursive locking problem

2006-11-03T20:27:57Z

When I was performing some operations on NFS, I got below error on server side. ============================================= [ INFO: possible recursive locking detected ] 2.6.19-prep #1 --------------------------------------------- nfsd4/3525 is trying to acquire lock: (&inode->i_mutex){--..}, at: [] mutex_lock+0x21/0x24 but task is already holding lock: (&inode->i_mutex){--..}, at: [] mutex_lock+0x21/0x24 other info that might help us debug this: 2 locks held by nfsd4/3525: #0: (client_mutex){--..}, at: [] mutex_lock+0x21/0x24 #1: (&inode->i_mutex){--..}, at: [] mutex_lock+0x21/0x24 stack backtrace: [] show_trace_log_lvl+0x58/0x16a [] show_trace+0xd/0x10 [] dump_stack+0x19/0x1b [] __lock_acquire+0x778/0x99c [] lock_acquire+0x4b/0x6d [] __mutex_lock_slowpath+0xbc/0x20a [] mutex_lock+0x21/0x24 [] vfs_rmdir+0x76/0xf8 [] nfsd4_clear_clid_dir+0x2c/0x41 [nfsd] [] nfsd4_remove_clid_dir+0xb1/0xe8 [nfsd] [] laundromat_main+0x9b/0x1c3 [nfsd] [] run_workqueue+0x7a/0xbb [] worker_thread+0xd2/0x107 [] kthread+0xc3/0xf2 [] kernel_thread_helper+0x5/0xb =================================================================== Cause for this problem was,2 successive mutex_lock calls on 2 diffrent inodes ,as shown below static int nfsd4_clear_clid_dir(struct dentry *dir, struct dentry *dentry) { int status; /* For now this directory should already be empty, but we empty it of * any regular files anyway, just in case the directory was created by * a kernel from the future.... */ nfsd4_list_rec_dir(dentry, nfsd4_remove_clid_file); mutex_lock(&dir->d_inode->i_mutex); status = vfs_rmdir(dir->d_inode, dentry); ... int vfs_rmdir(struct inode *dir, struct dentry *dentry) { int error = may_delete(dir, dentry, 1); if (error) return error; if (!dir->i_op || !dir->i_op->rmdir) return -EPERM; DQUOT_INIT(dir); mutex_lock(&dentry->d_inode->i_mutex); ... So I have developed the patch to overcome this problem. Signed-off-by: Srinivasa DS Cc: Neil Brown Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] nfsd: nfs_replay_me

2006-10-20T17:26:43Z

We are using NFS_REPLAY_ME as a special error value that is never leaked to clients. That works fine; the only problem is mixing host- and network- endian values in the same objects. Network-endian equivalent would work just as fine; switch to it. Signed-off-by: Al Viro Acked-by: Trond Myklebust Acked-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds