Revision e6838a29ecb484c97e4efef9429643b9851fba6e authored by J. Bruce Fields on 21 April 2017, 20:10:18 UTC, committed by J. Bruce Fields on 25 April 2017, 20:34:37 UTC
A client can append random data to the end of an NFSv2 or NFSv3 RPC call
without our complaining; we'll just stop parsing at the end of the
expected data and ignore the rest.

Encoded arguments and replies are stored together in an array of pages,
and if a call is too large it could leave inadequate space for the
reply.  This is normally OK because NFS RPC's typically have either
short arguments and long replies (like READ) or long arguments and short
replies (like WRITE).  But a client that sends an incorrectly long reply
can violate those assumptions.  This was observed to cause crashes.

Also, several operations increment rq_next_page in the decode routine
before checking the argument size, which can leave rq_next_page pointing
well past the end of the page array, causing trouble later in
svc_free_pages.

So, following a suggestion from Neil Brown, add a central check to
enforce our expectation that no NFSv2/v3 call has both a large call and
a large reply.

As followup we may also want to rewrite the encoding routines to check
more carefully that they aren't running off the end of the page array.

We may also consider rejecting calls that have any extra garbage
appended.  That would be safer, and within our rights by spec, but given
the age of our server and the NFS protocol, and the fact that we've
never enforced this before, we may need to balance that against the
possibility of breaking some oddball client.

Reported-by: Tuomas Haanpää <thaan@synopsys.com>
Reported-by: Ari Kauppi <ari@synopsys.com>
Cc: stable@vger.kernel.org
Reviewed-by: NeilBrown <neilb@suse.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
1 parent 5a7ad11
Raw File
show_delta
#!/usr/bin/python
#
# show_deltas: Read list of printk messages instrumented with
# time data, and format with time deltas.
#
# Also, you can show the times relative to a fixed point.
#
# Copyright 2003 Sony Corporation
#
# GPL 2.0 applies.

import sys
import string

def usage():
	print ("""usage: show_delta [<options>] <filename>

This program parses the output from a set of printk message lines which
have time data prefixed because the CONFIG_PRINTK_TIME option is set, or
the kernel command line option "time" is specified. When run with no
options, the time information is converted to show the time delta between
each printk line and the next.  When run with the '-b' option, all times
are relative to a single (base) point in time.

Options:
  -h            Show this usage help.
  -b <base>	Specify a base for time references.
		<base> can be a number or a string.
		If it is a string, the first message line
		which matches (at the beginning of the
		line) is used as the time reference.

ex: $ dmesg >timefile
    $ show_delta -b NET4 timefile

will show times relative to the line in the kernel output
starting with "NET4".
""")
	sys.exit(1)

# returns a tuple containing the seconds and text for each message line
# seconds is returned as a float
# raise an exception if no timing data was found
def get_time(line):
	if line[0]!="[":
		raise ValueError

	# split on closing bracket
	(time_str, rest) = string.split(line[1:],']',1)
	time = string.atof(time_str)

	#print "time=", time
	return (time, rest)


# average line looks like:
# [    0.084282] VFS: Mounted root (romfs filesystem) readonly
# time data is expressed in seconds.useconds,
# convert_line adds a delta for each line
last_time = 0.0
def convert_line(line, base_time):
	global last_time

	try:
		(time, rest) = get_time(line)
	except:
		# if any problem parsing time, don't convert anything
		return line

	if base_time:
		# show time from base
		delta = time - base_time
	else:
		# just show time from last line
		delta = time - last_time
		last_time = time

	return ("[%5.6f < %5.6f >]" % (time, delta)) + rest

def main():
	base_str = ""
	filein = ""
	for arg in sys.argv[1:]:
		if arg=="-b":
			base_str = sys.argv[sys.argv.index("-b")+1]
		elif arg=="-h":
			usage()
		else:
			filein = arg

	if not filein:
		usage()

	try:
		lines = open(filein,"r").readlines()
	except:
		print ("Problem opening file: %s" % filein)
		sys.exit(1)

	if base_str:
		print ('base= "%s"' % base_str)
		# assume a numeric base.  If that fails, try searching
		# for a matching line.
		try:
			base_time = float(base_str)
		except:
			# search for line matching <base> string
			found = 0
			for line in lines:
				try:
					(time, rest) = get_time(line)
				except:
					continue
				if string.find(rest, base_str)==1:
					base_time = time
					found = 1
					# stop at first match
					break
			if not found:
				print ('Couldn\'t find line matching base pattern "%s"' % base_str)
				sys.exit(1)
	else:
		base_time = 0.0

	for line in lines:
		print (convert_line(line, base_time),)

main()
back to top