Re: question about fh_copy

[Ming Zhang <blackmagic02881@gmail.com>]

On Sun, 2007-01-28 at 20:04 -0500, J. Bruce Fields wrote:
> On Sun, Jan 28, 2007 at 07:36:39PM -0500, Ming Zhang wrote:
> > On Sun, 2007-01-28 at 18:01 -0500, J. Bruce Fields wrote:
> > > On Sat, Jan 27, 2007 at 10:20:08AM -0500, Ming Zhang wrote:
> > > > A question about fh_copy(). This function is called many times on
> > > > argument passed directly from nfs clients. If a malicious nfs client
> > > > forge a fh, then fh_copy can invoke oops quite easily.
> > > 
> > > I don't see how; can you explain?
> > 
> > svc_process at http://lxr.linux.no/source/net/sunrpc/svc.c?v=2.6.18#L386
> > invoke a rpc processing function, for example, nfsd3_proc_getattr
> > then at http://lxr.linux.no/source/fs/nfsd/nfs3proc.c?v=2.6.18#L64
> > invoke fh_copy before fh_verify. since src coming from client, client
> > can forge a fh to let code
> > http://lxr.linux.no/source/include/linux/nfsd/nfsfh.h?v=2.6.18#L222 get
> > executed. if fh_dentry is a invalid pointer, it can get oops.
> 
> The fh_dentry field does not contain client-provided data; look at
> nfs3xdr.c:decode_fh() to see how the svc_fh structure is initialized.

my fault. in decode_fh, it only copy fh_handle. i read it too fast and
thought it copy the whole svc_fh.

sorry for the noise.



> 
> --b.
-- 
http://blackmagic02881.wordpress.com/


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs