linux/fs/nfsd
J. Bruce Fields 074b07d94e nfsd: fix crash on COPY_NOTIFY with special stateid
RTM says "If the special ONE stateid is passed to
nfs4_preprocess_stateid_op(), it returns status=0 but does not set
*cstid. nfsd4_copy_notify() depends on stid being set if status=0, and
thus can crash if the client sends the right COPY_NOTIFY RPC."

RFC 7862 says "The cna_src_stateid MUST refer to either open or locking
states provided earlier by the server.  If it is invalid, then the
operation MUST fail."

The RFC doesn't specify an error, and the choice doesn't matter much as
this is clearly illegal client behavior, but bad_stateid seems
reasonable.

Simplest is just to guarantee that nfs4_preprocess_stateid_op, called
with non-NULL cstid, errors out if it can't return a stateid.

Reported-by: rtm@csail.mit.edu
Fixes: 624322f1ad ("NFSD add COPY_NOTIFY operation")
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Olga Kornievskaia <kolga@netapp.com>
Tested-by: Olga Kornievskaia <kolga@netapp.com>
2022-01-08 14:42:03 -05:00
..
acl.h nfsd: eliminate an unnecessary acl size limit 2019-08-28 21:13:45 -04:00
auth.c nfsd: auth: Fix gid sorting when rootsquash enabled 2018-01-22 20:13:07 -08:00
auth.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
blocklayout.c nfsd/blocklayout: use ->get_unique_id instead of sending SCSI commands 2021-10-22 08:33:57 -06:00
blocklayoutxdr.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
blocklayoutxdr.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cache.h nfsd4: make drc_slab global, not per-net 2020-06-01 17:44:45 -04:00
current_stateid.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
export.c idmapped-mounts-v5.12 2021-02-23 13:39:45 -08:00
export.h nfsd: report per-export stats 2021-01-25 09:36:28 -05:00
fault_inject.c nfsd: no need to check return value of debugfs_create functions 2019-07-03 16:57:17 +02:00
filecache.c NFSD: Rename boot verifier functions 2022-01-08 14:42:02 -05:00
filecache.h nfsd: Replace use of rwsem with errseq_t 2022-01-08 14:42:02 -05:00
flexfilelayout.c NFSD: simplify struct nfsfh 2021-10-02 15:51:10 -04:00
flexfilelayoutxdr.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
flexfilelayoutxdr.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
idmap.h
Kconfig nfsd/blocklayout: use ->get_unique_id instead of sending SCSI commands 2021-10-22 08:33:57 -06:00
lockd.c NFSD: simplify struct nfsfh 2021-10-02 15:51:10 -04:00
Makefile nfsd: remove fault injection code 2020-09-25 18:01:26 -04:00
netns.h NFSD: Rename boot verifier functions 2022-01-08 14:42:02 -05:00
nfs2acl.c SUNRPC: Change return value type of .pc_encode 2021-10-13 11:34:49 -04:00
nfs3acl.c SUNRPC: Change return value type of .pc_encode 2021-10-13 11:34:49 -04:00
nfs3proc.c NFSD: Fix zero-length NFSv3 WRITEs 2022-01-08 14:42:01 -05:00
nfs3xdr.c NFSD: Move fill_pre_wcc() and fill_post_wcc() 2022-01-08 14:42:03 -05:00
nfs4acl.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
nfs4callback.c NFSD: simplify struct nfsfh 2021-10-02 15:51:10 -04:00
nfs4idmap.c nfsd: Use seq_putc() in two functions 2020-07-13 17:28:46 -04:00
nfs4layouts.c nfsd/blocklayout: use ->get_unique_id instead of sending SCSI commands 2021-10-22 08:33:57 -06:00
nfs4proc.c NFSD: Move fill_pre_wcc() and fill_post_wcc() 2022-01-08 14:42:03 -05:00
nfs4recover.c nfsd: Fix nsfd startup race (again) 2021-12-10 11:54:59 -05:00
nfs4state.c nfsd: fix crash on COPY_NOTIFY with special stateid 2022-01-08 14:42:03 -05:00
nfs4xdr.c NFSD: De-duplicate nfsd4_decode_bitmap4() 2022-01-08 14:42:01 -05:00
nfscache.c NFSD: Remove be32_to_cpu() from DRC hash function 2021-12-13 13:42:59 -05:00
nfsctl.c NFSD: Clean up the nfsd_net::nfssvc_boot field 2022-01-08 14:42:02 -05:00
nfsd.h SUNRPC/NFSD: clean up get/put functions. 2021-12-13 13:42:50 -05:00
nfsfh.c NFSD: Move fill_pre_wcc() and fill_post_wcc() 2022-01-08 14:42:03 -05:00
nfsfh.h NFSD: Move fill_pre_wcc() and fill_post_wcc() 2022-01-08 14:42:03 -05:00
nfsproc.c nfsd: Retry once in nfsd_open on an -EOPENSTALE return 2022-01-08 14:42:02 -05:00
nfssvc.c NFSD: Rename boot verifier functions 2022-01-08 14:42:02 -05:00
nfsxdr.c SUNRPC: Change return value type of .pc_encode 2021-10-13 11:34:49 -04:00
pnfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
state.h nfsd4: add refcount for nfsd4_blocked_lock 2022-01-08 14:42:01 -05:00
stats.c nfsd: make nfsd_stats.th_cnt atomic_t 2021-12-13 13:42:51 -05:00
stats.h nfsd: make nfsd_stats.th_cnt atomic_t 2021-12-13 13:42:51 -05:00
trace.c NFSD: Add SPDX header for fs/nfsd/trace.c 2020-11-30 13:00:24 -05:00
trace.h NFSD: Trace boot verifier resets 2022-01-08 14:42:03 -05:00
vfs.c NFSD: Move fill_pre_wcc() and fill_post_wcc() 2022-01-08 14:42:03 -05:00
vfs.h nfsd: Add a tracepoint for errors in nfsd4_clone_file_range() 2022-01-08 14:42:02 -05:00
xdr3.h SUNRPC: Change return value type of .pc_encode 2021-10-13 11:34:49 -04:00
xdr4.h SUNRPC: Change return value type of .pc_encode 2021-10-13 11:34:49 -04:00
xdr4cb.h NFSD CB_OFFLOAD xdr 2018-09-25 20:34:54 -04:00
xdr.h SUNRPC: Change return value type of .pc_encode 2021-10-13 11:34:49 -04:00