[PATCH 4.12 013/106] NFSv4: Fix EXCHANGE_ID corrupt verifier issue

[Greg Kroah-Hartman]

4.12-stable review patch.  If anyone has any objections, please let me know.

--

From: Trond Myklebust 

commit fd40559c8657418385e42f797e0b04bfc0add748 upstream.

The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was
changed to be asynchronous by commit 8d89bd70bc939. If we interrrupt
the call to rpc_wait_for_completion_task(), we can therefore end up
transmitting random stack contents in lieu of the verifier.

Fixes: 8d89bd70bc939 ("NFS setup async exchange_id")
Signed-off-by: Trond Myklebust 
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/nfs/nfs4proc.c   |   11 ---
 fs/nfs/nfs4xdr.c|2 +-
 include/linux/nfs_xdr.h |2 +-
 3 files changed, 6 insertions(+), 9 deletions(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7407,7 +7407,7 @@ static void nfs4_exchange_id_done(struct
cdata->res.server_scope = NULL;
}
/* Save the EXCHANGE_ID verifier session trunk tests */
-   memcpy(clp->cl_confirm.data, cdata->args.verifier->data,
+   memcpy(clp->cl_confirm.data, cdata->args.verifier.data,
   sizeof(clp->cl_confirm.data));
}
 out:
@@ -7444,7 +7444,6 @@ static const struct rpc_call_ops nfs4_ex
 static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred 
*cred,
u32 sp4_how, struct rpc_xprt *xprt)
 {
-   nfs4_verifier verifier;
struct rpc_message msg = {
.rpc_proc = _procedures[NFSPROC4_CLNT_EXCHANGE_ID],
.rpc_cred = cred,
@@ -7468,8 +7467,7 @@ static int _nfs4_proc_exchange_id(struct
return -ENOMEM;
}
 
-   if (!xprt)
-   nfs4_init_boot_verifier(clp, );
+   nfs4_init_boot_verifier(clp, >args.verifier);
 
status = nfs4_init_uniform_client_string(clp);
if (status)
@@ -7510,9 +7508,8 @@ static int _nfs4_proc_exchange_id(struct
task_setup_data.rpc_xprt = xprt;
task_setup_data.flags =
RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;
-   calldata->args.verifier = >cl_confirm;
-   } else {
-   calldata->args.verifier = 
+   memcpy(calldata->args.verifier.data, clp->cl_confirm.data,
+   sizeof(calldata->args.verifier.data));
}
calldata->args.client = clp;
 #ifdef CONFIG_NFS_V4_1_MIGRATION
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1765,7 +1765,7 @@ static void encode_exchange_id(struct xd
int len = 0;
 
encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);
-   encode_nfs4_verifier(xdr, args->verifier);
+   encode_nfs4_verifier(xdr, >verifier);
 
encode_string(xdr, strlen(args->client->cl_owner_id),
args->client->cl_owner_id);
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1222,7 +1222,7 @@ struct nfs41_state_protection {
 
 struct nfs41_exchange_id_args {
struct nfs_client   *client;
-   nfs4_verifier   *verifier;
+   nfs4_verifier   verifier;
u32 flags;
struct nfs41_state_protection   state_protect;
 };

[PATCH 4.12 013/106] NFSv4: Fix EXCHANGE_ID corrupt verifier issue

[Greg Kroah-Hartman]

4.12-stable review patch.  If anyone has any objections, please let me know.

--

From: Trond Myklebust 

commit fd40559c8657418385e42f797e0b04bfc0add748 upstream.

The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was
changed to be asynchronous by commit 8d89bd70bc939. If we interrrupt
the call to rpc_wait_for_completion_task(), we can therefore end up
transmitting random stack contents in lieu of the verifier.

Fixes: 8d89bd70bc939 ("NFS setup async exchange_id")
Signed-off-by: Trond Myklebust 
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/nfs/nfs4proc.c   |   11 ---
 fs/nfs/nfs4xdr.c|2 +-
 include/linux/nfs_xdr.h |2 +-
 3 files changed, 6 insertions(+), 9 deletions(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7407,7 +7407,7 @@ static void nfs4_exchange_id_done(struct
cdata->res.server_scope = NULL;
}
/* Save the EXCHANGE_ID verifier session trunk tests */
-   memcpy(clp->cl_confirm.data, cdata->args.verifier->data,
+   memcpy(clp->cl_confirm.data, cdata->args.verifier.data,
   sizeof(clp->cl_confirm.data));
}
 out:
@@ -7444,7 +7444,6 @@ static const struct rpc_call_ops nfs4_ex
 static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred 
*cred,
u32 sp4_how, struct rpc_xprt *xprt)
 {
-   nfs4_verifier verifier;
struct rpc_message msg = {
.rpc_proc = _procedures[NFSPROC4_CLNT_EXCHANGE_ID],
.rpc_cred = cred,
@@ -7468,8 +7467,7 @@ static int _nfs4_proc_exchange_id(struct
return -ENOMEM;
}
 
-   if (!xprt)
-   nfs4_init_boot_verifier(clp, );
+   nfs4_init_boot_verifier(clp, >args.verifier);
 
status = nfs4_init_uniform_client_string(clp);
if (status)
@@ -7510,9 +7508,8 @@ static int _nfs4_proc_exchange_id(struct
task_setup_data.rpc_xprt = xprt;
task_setup_data.flags =
RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;
-   calldata->args.verifier = >cl_confirm;
-   } else {
-   calldata->args.verifier = 
+   memcpy(calldata->args.verifier.data, clp->cl_confirm.data,
+   sizeof(calldata->args.verifier.data));
}
calldata->args.client = clp;
 #ifdef CONFIG_NFS_V4_1_MIGRATION
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1765,7 +1765,7 @@ static void encode_exchange_id(struct xd
int len = 0;
 
encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);
-   encode_nfs4_verifier(xdr, args->verifier);
+   encode_nfs4_verifier(xdr, >verifier);
 
encode_string(xdr, strlen(args->client->cl_owner_id),
args->client->cl_owner_id);
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1222,7 +1222,7 @@ struct nfs41_state_protection {
 
 struct nfs41_exchange_id_args {
struct nfs_client   *client;
-   nfs4_verifier   *verifier;
+   nfs4_verifier   verifier;
u32 flags;
struct nfs41_state_protection   state_protect;
 };