1. 21 3月, 2006 36 次提交
  2. 14 3月, 2006 2 次提交
    • T
      [PATCH] NFSv4: fix mount segfault on errors returned that are < -1000 · c12e87f4
      Trond Myklebust 提交于
      It turns out that nfs4_proc_get_root() may return raw NFSv4 errors instead of
      mapping them to kernel errors.  Problem spotted by Neil Horman
      <nhorman@tuxdriver.com>
      Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      c12e87f4
    • T
      [PATCH] NFS: Fix a potential panic in O_DIRECT · 143f412e
      Trond Myklebust 提交于
      Based on an original patch by Mike O'Connor and Greg Banks of SGI.
      
      Mike states:
      
      A normal user can panic an NFS client and cause a local DoS with
      'judicious'(?) use of O_DIRECT.  Any O_DIRECT write to an NFS file where the
      user buffer starts with a valid mapped page and contains an unmapped page,
      will crash in this way.  I haven't followed the code, but O_DIRECT reads with
      similar user buffers will probably also crash albeit in different ways.
      
      Details: when nfs_get_user_pages() calls get_user_pages(), it detects and
      correctly handles get_user_pages() returning an error, which happens if the
      first page covered by the user buffer's address range is unmapped.  However,
      if the first page is mapped but some subsequent page isn't, get_user_pages()
      will return a positive number which is less than the number of pages requested
      (this behaviour is sort of analagous to a short write() call and appears to be
      intentional).  nfs_get_user_pages() doesn't detect this and hands off the
      array of pages (whose last few elements are random rubbish from the newly
      allocated array memory) to it's caller, whence they go to
      nfs_direct_write_seg(), which then totally ignores the nr_pages it's given,
      and calculates its own idea of how many pages are in the array from the user
      buffer length.  Needless to say, when it comes to transmit those uninitialised
      page* pointers, we see a crash in the network stack.
      Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      143f412e
  3. 08 2月, 2006 1 次提交
    • A
      [PATCH] nfsroot port= parameter fix [backport of 2.4 fix] · 8854eddb
      Al Viro 提交于
      Direct backport of 2.4 fix that didn't get propagated to 2.6; original
      comment follows:
      <quote>
         When I specify the NFS port for nfsroot (e.g.,
         nfsroot=<dir>,port=2049), the
         kernel uses the wrong port. In my case it tries to use 264 (0x108)
         instead
         of 2049 (0x801).
      
         This patch adds the missing htons().
      
         Eric
      </quote>
      
      Patch got applied in 2.4.21-pre6.  Author: Eric Lammerts (<eric@lammerts.org>,
      AFAICS).
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      8854eddb
  4. 02 2月, 2006 1 次提交