Revision e6838a29ecb484c97e4efef9429643b9851fba6e authored by J. Bruce Fields on 21 April 2017, 20:10:18 UTC, committed by J. Bruce Fields on 25 April 2017, 20:34:37 UTC
A client can append random data to the end of an NFSv2 or NFSv3 RPC call without our complaining; we'll just stop parsing at the end of the expected data and ignore the rest. Encoded arguments and replies are stored together in an array of pages, and if a call is too large it could leave inadequate space for the reply. This is normally OK because NFS RPC's typically have either short arguments and long replies (like READ) or long arguments and short replies (like WRITE). But a client that sends an incorrectly long reply can violate those assumptions. This was observed to cause crashes. Also, several operations increment rq_next_page in the decode routine before checking the argument size, which can leave rq_next_page pointing well past the end of the page array, causing trouble later in svc_free_pages. So, following a suggestion from Neil Brown, add a central check to enforce our expectation that no NFSv2/v3 call has both a large call and a large reply. As followup we may also want to rewrite the encoding routines to check more carefully that they aren't running off the end of the page array. We may also consider rejecting calls that have any extra garbage appended. That would be safer, and within our rights by spec, but given the age of our server and the NFS protocol, and the fact that we've never enforced this before, we may need to balance that against the possibility of breaking some oddball client. Reported-by: Tuomas Haanpää <thaan@synopsys.com> Reported-by: Ari Kauppi <ari@synopsys.com> Cc: stable@vger.kernel.org Reviewed-by: NeilBrown <neilb@suse.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
1 parent 5a7ad11
show_delta
#!/usr/bin/python
#
# show_deltas: Read list of printk messages instrumented with
# time data, and format with time deltas.
#
# Also, you can show the times relative to a fixed point.
#
# Copyright 2003 Sony Corporation
#
# GPL 2.0 applies.
import sys
import string
def usage():
print ("""usage: show_delta [<options>] <filename>
This program parses the output from a set of printk message lines which
have time data prefixed because the CONFIG_PRINTK_TIME option is set, or
the kernel command line option "time" is specified. When run with no
options, the time information is converted to show the time delta between
each printk line and the next. When run with the '-b' option, all times
are relative to a single (base) point in time.
Options:
-h Show this usage help.
-b <base> Specify a base for time references.
<base> can be a number or a string.
If it is a string, the first message line
which matches (at the beginning of the
line) is used as the time reference.
ex: $ dmesg >timefile
$ show_delta -b NET4 timefile
will show times relative to the line in the kernel output
starting with "NET4".
""")
sys.exit(1)
# returns a tuple containing the seconds and text for each message line
# seconds is returned as a float
# raise an exception if no timing data was found
def get_time(line):
if line[0]!="[":
raise ValueError
# split on closing bracket
(time_str, rest) = string.split(line[1:],']',1)
time = string.atof(time_str)
#print "time=", time
return (time, rest)
# average line looks like:
# [ 0.084282] VFS: Mounted root (romfs filesystem) readonly
# time data is expressed in seconds.useconds,
# convert_line adds a delta for each line
last_time = 0.0
def convert_line(line, base_time):
global last_time
try:
(time, rest) = get_time(line)
except:
# if any problem parsing time, don't convert anything
return line
if base_time:
# show time from base
delta = time - base_time
else:
# just show time from last line
delta = time - last_time
last_time = time
return ("[%5.6f < %5.6f >]" % (time, delta)) + rest
def main():
base_str = ""
filein = ""
for arg in sys.argv[1:]:
if arg=="-b":
base_str = sys.argv[sys.argv.index("-b")+1]
elif arg=="-h":
usage()
else:
filein = arg
if not filein:
usage()
try:
lines = open(filein,"r").readlines()
except:
print ("Problem opening file: %s" % filein)
sys.exit(1)
if base_str:
print ('base= "%s"' % base_str)
# assume a numeric base. If that fails, try searching
# for a matching line.
try:
base_time = float(base_str)
except:
# search for line matching <base> string
found = 0
for line in lines:
try:
(time, rest) = get_time(line)
except:
continue
if string.find(rest, base_str)==1:
base_time = time
found = 1
# stop at first match
break
if not found:
print ('Couldn\'t find line matching base pattern "%s"' % base_str)
sys.exit(1)
else:
base_time = 0.0
for line in lines:
print (convert_line(line, base_time),)
main()
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...