NFSv4: Fix EXCHANGE_ID corrupt verifier issue

The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was
changed to be asynchronous by commit 8d89bd70bc939. If we interrrupt
the call to rpc_wait_for_completion_task(), we can therefore end up
transmitting random stack contents in lieu of the verifier.

Fixes: 8d89bd70bc939 ("NFS setup async exchange_id")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 93c1d735223861e845ffd256cb94ef4ef9a455ad..c458a1e28b9174a5857b0656c5158e232e35024c 100644 (file)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7460,7 +7460,7 @@ static void nfs4_exchange_id_done(struct rpc_task *task, void *data)
                        cdata->res.server_scope = NULL;
                }
                /* Save the EXCHANGE_ID verifier session trunk tests */
-               memcpy(clp->cl_confirm.data, cdata->args.verifier->data,
+               memcpy(clp->cl_confirm.data, cdata->args.verifier.data,
                       sizeof(clp->cl_confirm.data));
        }
 out:
@@ -7497,7 +7497,6 @@ static const struct rpc_call_ops nfs4_exchange_id_call_ops = {
 static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
                        u32 sp4_how, struct rpc_xprt *xprt)
 {
-       nfs4_verifier verifier;
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_EXCHANGE_ID],
                .rpc_cred = cred,
@@ -7521,8 +7520,7 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
                return -ENOMEM;
        }
 
-       if (!xprt)
-               nfs4_init_boot_verifier(clp, &verifier);
+       nfs4_init_boot_verifier(clp, &calldata->args.verifier);
 
        status = nfs4_init_uniform_client_string(clp);
        if (status)
@@ -7563,9 +7561,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
                task_setup_data.rpc_xprt = xprt;
                task_setup_data.flags =
                                RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;
-               calldata->args.verifier = &clp->cl_confirm;
-       } else {
-               calldata->args.verifier = &verifier;
+               memcpy(calldata->args.verifier.data, clp->cl_confirm.data,
+                               sizeof(calldata->args.verifier.data));
        }
        calldata->args.client = clp;
 #ifdef CONFIG_NFS_V4_1_MIGRATION

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index fa3eb361d4f863be18072272293dcbdcedfd887f..37c8af00327588d772610cac487fcf0651cf8fbf 100644 (file)
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1785,7 +1785,7 @@ static void encode_exchange_id(struct xdr_stream *xdr,
        int len = 0;
 
        encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);
-       encode_nfs4_verifier(xdr, args->verifier);
+       encode_nfs4_verifier(xdr, &args->verifier);
 
        encode_string(xdr, strlen(args->client->cl_owner_id),
                        args->client->cl_owner_id);

diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index ca3bcc4ed4e55563ecd505fada0cc0dc1f5dbb8d..62cbcb842f99c2cbda7121bcb5a4ebc5e818a3bc 100644 (file)
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1235,7 +1235,7 @@ struct nfs41_state_protection {
 
 struct nfs41_exchange_id_args {
        struct nfs_client               *client;
-       nfs4_verifier                   *verifier;
+       nfs4_verifier                   verifier;
        u32                             flags;
        struct nfs41_state_protection   state_protect;
 };