1. 09 7月, 2014 6 次提交
    • J
      nfsd4: replace defer_free by svcxdr_tmpalloc · d5e23383
      J. Bruce Fields 提交于
      Avoid an extra allocation for the tmpbuf struct itself, and stop
      ignoring some allocation failures.
      Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
      d5e23383
    • J
      nfsd4: remove nfs4_acl_new · bcaab953
      J. Bruce Fields 提交于
      This is a not-that-useful kmalloc wrapper.  And I'd like one of the
      callers to actually use something other than kmalloc.
      Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
      bcaab953
    • J
      29c353b3
    • J
      nfsd4: remove unused defer_free argument · ce043ac8
      J. Bruce Fields 提交于
      28e05dd8 "knfsd: nfsd4: represent nfsv4 acl with array instead of
      linked list" removed the last user that wanted a custom free function.
      Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
      ce043ac8
    • J
      nfsd4: rename cr_linkname->cr_data · 7fb84306
      J. Bruce Fields 提交于
      The name of a link is currently stored in cr_name and cr_namelen, and
      the content in cr_linkname and cr_linklen.  That's confusing.
      Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
      7fb84306
    • J
      nfsd: fix rare symlink decoding bug · b829e919
      J. Bruce Fields 提交于
      An NFS operation that creates a new symlink includes the symlink data,
      which is xdr-encoded as a length followed by the data plus 0 to 3 bytes
      of zero-padding as required to reach a 4-byte boundary.
      
      The vfs, on the other hand, wants null-terminated data.
      
      The simple way to handle this would be by copying the data into a newly
      allocated buffer with space for the final null.
      
      The current nfsd_symlink code tries to be more clever by skipping that
      step in the (likely) case where the byte following the string is already
      0.
      
      But that assumes that the byte following the string is ours to look at.
      In fact, it might be the first byte of a page that we can't read, or of
      some object that another task might modify.
      
      Worse, the NFSv4 code tries to fix the problem by actually writing to
      that byte.
      
      In the NFSv2/v3 cases this actually appears to be safe:
      
      	- nfs3svc_decode_symlinkargs explicitly null-terminates the data
      	  (after first checking its length and copying it to a new
      	  page).
      	- NFSv2 limits symlinks to 1k.  The buffer holding the rpc
      	  request is always at least a page, and the link data (and
      	  previous fields) have maximum lengths that prevent the request
      	  from reaching the end of a page.
      
      In the NFSv4 case the CREATE op is potentially just one part of a long
      compound so can end up on the end of a page if you're unlucky.
      
      The minimal fix here is to copy and null-terminate in the NFSv4 case.
      The nfsd_symlink() interface here seems too fragile, though.  It should
      really either do the copy itself every time or just require a
      null-terminated string.
      Reported-by: NJeff Layton <jlayton@primarydata.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
      b829e919
  2. 23 6月, 2014 1 次提交
  3. 18 6月, 2014 1 次提交
  4. 07 6月, 2014 2 次提交
  5. 31 5月, 2014 30 次提交