nfsd: more careful input validation in nfsctl write methods

[safe/jmp/linux-2.6] / fs / nfsd / nfsctl.c

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 39aed90..8516137 100644 (file)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -35,7 +35,6 @@
 #include <linux/nfsd/cache.h>
 #include <linux/nfsd/xdr.h>
 #include <linux/nfsd/syscall.h>
-#include <linux/nfsd/interface.h>
 
 #include <asm/uaccess.h>
 
@@ -111,7 +110,7 @@ static ssize_t (*write_op[])(struct file *, char *, size_t) = {
 
 static ssize_t nfsctl_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
 {
-       ino_t ino =  file->f_dentry->d_inode->i_ino;
+       ino_t ino =  file->f_path.dentry->d_inode->i_ino;
        char *data;
        ssize_t rv;
 
@@ -123,7 +122,7 @@ static ssize_t nfsctl_transaction_write(struct file *file, const char __user *bu
                return PTR_ERR(data);
 
        rv =  write_op[ino](file, data, size);
-       if (rv>0) {
+       if (rv >= 0) {
                simple_transaction_set(file, rv);
                rv = size;
        }
@@ -245,7 +244,7 @@ static ssize_t write_getfs(struct file *file, char *buf, size_t size)
        }
        exp_readunlock();
        if (err == 0)
-               err = res->fh_size + (int)&((struct knfsd_fh*)0)->fh_base;
+               err = res->fh_size + offsetof(struct knfsd_fh, fh_base);
  out:
        return err;
 }
@@ -299,12 +298,15 @@ static ssize_t write_filehandle(struct file *file, char *buf, size_t size)
         * qword quoting is used, so filehandle will be \x....
         */
        char *dname, *path;
-       int maxsize;
+       int uninitialized_var(maxsize);
        char *mesg = buf;
        int len;
        struct auth_domain *dom;
        struct knfsd_fh fh;
 
+       if (size == 0)
+               return -EINVAL;
+
        if (buf[size-1] != '\n')
                return -EINVAL;
        buf[size-1] = 0;
@@ -504,7 +506,7 @@ static ssize_t write_ports(struct file *file, char *buf, size_t size)
                int len = 0;
                lock_kernel();
                if (nfsd_serv)
-                       len = svc_sock_names(buf, nfsd_serv, NULL);
+                       len = svc_xprt_names(nfsd_serv, buf, 0);
                unlock_kernel();
                return len;
        }
@@ -541,7 +543,7 @@ static ssize_t write_ports(struct file *file, char *buf, size_t size)
                }
                return err < 0 ? err : 0;
        }
-       if (buf[0] == '-') {
+       if (buf[0] == '-' && isdigit(buf[1])) {
                char *toclose = kstrdup(buf+1, GFP_KERNEL);
                int len = 0;
                if (!toclose)
@@ -555,6 +557,53 @@ static ssize_t write_ports(struct file *file, char *buf, size_t size)
                kfree(toclose);
                return len;
        }
+       /*
+        * Add a transport listener by writing it's transport name
+        */
+       if (isalpha(buf[0])) {
+               int err;
+               char transport[16];
+               int port;
+               if (sscanf(buf, "%15s %4d", transport, &port) == 2) {
+                       err = nfsd_create_serv();
+                       if (!err) {
+                               err = svc_create_xprt(nfsd_serv,
+                                                     transport, port,
+                                                     SVC_SOCK_ANONYMOUS);
+                               if (err == -ENOENT)
+                                       /* Give a reasonable perror msg for
+                                        * bad transport string */
+                                       err = -EPROTONOSUPPORT;
+                       }
+                       return err < 0 ? err : 0;
+               }
+       }
+       /*
+        * Remove a transport by writing it's transport name and port number
+        */
+       if (buf[0] == '-' && isalpha(buf[1])) {
+               struct svc_xprt *xprt;
+               int err = -EINVAL;
+               char transport[16];
+               int port;
+               if (sscanf(&buf[1], "%15s %4d", transport, &port) == 2) {
+                       if (port == 0)
+                               return -EINVAL;
+                       lock_kernel();
+                       if (nfsd_serv) {
+                               xprt = svc_find_xprt(nfsd_serv, transport,
+                                                    AF_UNSPEC, port);
+                               if (xprt) {
+                                       svc_close_xprt(xprt);
+                                       svc_xprt_put(xprt);
+                                       err = 0;
+                               } else
+                                       err = -ENOTCONN;
+                       }
+                       unlock_kernel();
+                       return err < 0 ? err : 0;
+               }
+       }
        return -EINVAL;
 }
 
@@ -617,7 +666,7 @@ static ssize_t write_recoverydir(struct file *file, char *buf, size_t size)
        char *recdir;
        int len, status;
 
-       if (size > PATH_MAX || buf[size-1] != '\n')
+       if (size == 0 || size > PATH_MAX || buf[size-1] != '\n')
                return -EINVAL;
        buf[size-1] = 0;
 
@@ -675,44 +724,79 @@ static struct file_system_type nfsd_fs_type = {
        .kill_sb        = kill_litter_super,
 };
 
+#ifdef CONFIG_PROC_FS
+static int create_proc_exports_entry(void)
+{
+       struct proc_dir_entry *entry;
+
+       entry = proc_mkdir("fs/nfs", NULL);
+       if (!entry)
+               return -ENOMEM;
+       entry = create_proc_entry("fs/nfs/exports", 0, NULL);
+       if (!entry)
+               return -ENOMEM;
+       entry->proc_fops =  &exports_operations;
+       return 0;
+}
+#else /* CONFIG_PROC_FS */
+static int create_proc_exports_entry(void)
+{
+       return 0;
+}
+#endif
+
 static int __init init_nfsd(void)
 {
        int retval;
        printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n");
 
+       retval = nfs4_state_init(); /* nfs4 locking state */
+       if (retval)
+               return retval;
        nfsd_stat_init();       /* Statistics */
-       nfsd_cache_init();      /* RPC reply cache */
-       nfsd_export_init();     /* Exports table */
+       retval = nfsd_reply_cache_init();
+       if (retval)
+               goto out_free_stat;
+       retval = nfsd_export_init();
+       if (retval)
+               goto out_free_cache;
        nfsd_lockd_init();      /* lockd->nfsd callbacks */
-       nfs4_state_init();      /* NFSv4 locking state */
-       nfsd_idmap_init();      /* Name to ID mapping */
-       if (proc_mkdir("fs/nfs", NULL)) {
-               struct proc_dir_entry *entry;
-               entry = create_proc_entry("fs/nfs/exports", 0, NULL);
-               if (entry)
-                       entry->proc_fops =  &exports_operations;
-       }
+       retval = nfsd_idmap_init();
+       if (retval)
+               goto out_free_lockd;
+       retval = create_proc_exports_entry();
+       if (retval)
+               goto out_free_idmap;
        retval = register_filesystem(&nfsd_fs_type);
-       if (retval) {
-               nfsd_export_shutdown();
-               nfsd_cache_shutdown();
-               remove_proc_entry("fs/nfs/exports", NULL);
-               remove_proc_entry("fs/nfs", NULL);
-               nfsd_stat_shutdown();
-               nfsd_lockd_shutdown();
-       }
+       if (retval)
+               goto out_free_all;
+       return 0;
+out_free_all:
+       remove_proc_entry("fs/nfs/exports", NULL);
+       remove_proc_entry("fs/nfs", NULL);
+out_free_idmap:
+       nfsd_idmap_shutdown();
+out_free_lockd:
+       nfsd_lockd_shutdown();
+       nfsd_export_shutdown();
+out_free_cache:
+       nfsd_reply_cache_shutdown();
+out_free_stat:
+       nfsd_stat_shutdown();
+       nfsd4_free_slabs();
        return retval;
 }
 
 static void __exit exit_nfsd(void)
 {
        nfsd_export_shutdown();
-       nfsd_cache_shutdown();
+       nfsd_reply_cache_shutdown();
        remove_proc_entry("fs/nfs/exports", NULL);
        remove_proc_entry("fs/nfs", NULL);
        nfsd_stat_shutdown();
        nfsd_lockd_shutdown();
        nfsd_idmap_shutdown();
+       nfsd4_free_slabs();
        unregister_filesystem(&nfsd_fs_type);
 }