提交 d1a8016a 编写于 作者: B Bryan Schumaker 提交者: Trond Myklebust

NFS: Fix infinite loop in gss_create_upcall()

There can be an infinite loop if gss_create_upcall() is called without
the userspace program running.  To prevent this, we return -EACCES if
we notice that pipe_version hasn't changed (indicating that the pipe
has not been opened).
Signed-off-by: NBryan Schumaker <bjschuma@netapp.com>
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
上级 79a48a1f
...@@ -2224,8 +2224,9 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle, ...@@ -2224,8 +2224,9 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
for (i = 0; i < len; i++) { for (i = 0; i < len; i++) {
status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]); status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);
if (status != -EPERM) if (status == -EPERM || status == -EACCES)
break; continue;
break;
} }
if (status == 0) if (status == 0)
status = nfs4_server_capabilities(server, fhandle); status = nfs4_server_capabilities(server, fhandle);
......
...@@ -520,7 +520,7 @@ gss_refresh_upcall(struct rpc_task *task) ...@@ -520,7 +520,7 @@ gss_refresh_upcall(struct rpc_task *task)
warn_gssd(); warn_gssd();
task->tk_timeout = 15*HZ; task->tk_timeout = 15*HZ;
rpc_sleep_on(&pipe_version_rpc_waitqueue, task, NULL); rpc_sleep_on(&pipe_version_rpc_waitqueue, task, NULL);
return 0; return -EAGAIN;
} }
if (IS_ERR(gss_msg)) { if (IS_ERR(gss_msg)) {
err = PTR_ERR(gss_msg); err = PTR_ERR(gss_msg);
...@@ -563,10 +563,12 @@ gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred) ...@@ -563,10 +563,12 @@ gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
if (PTR_ERR(gss_msg) == -EAGAIN) { if (PTR_ERR(gss_msg) == -EAGAIN) {
err = wait_event_interruptible_timeout(pipe_version_waitqueue, err = wait_event_interruptible_timeout(pipe_version_waitqueue,
pipe_version >= 0, 15*HZ); pipe_version >= 0, 15*HZ);
if (pipe_version < 0) {
warn_gssd();
err = -EACCES;
}
if (err) if (err)
goto out; goto out;
if (pipe_version < 0)
warn_gssd();
goto retry; goto retry;
} }
if (IS_ERR(gss_msg)) { if (IS_ERR(gss_msg)) {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册