linux-kernel - Re: [PATCH] Fix NFS option parsing bit-rot.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 6 Jun 2016 23:49:10 +0000
From:	Trond Myklebust <trondmy@...marydata.com>
To:	Rob Landley <rob@...dley.net>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Anna Schumaker <anna.schumaker@...app.com>,
	"linux-nfs@...r.kernel.org" <linux-nfs@...r.kernel.org>
Subject: Re: [PATCH] Fix NFS option parsing bit-rot.



On 6/6/16, 18:58, "Rob Landley" <rob@...dley.net> wrote:

>From: Rob Landley <rob@...dley.net>
>
>The kernel has string parsing code for NFS mount options, but it seems
>to have bit-rotted over the years, so toybox mount needs the following
>patch to be able to mount nfs. Without it, the kernel returns "invalid
>argument" before sending any network traffic.
>
>For more information, see
>http://lists.landley.net/pipermail/toybox-landley.net/2016-March/004790.html
>
>Signed-off-by: Rob Landley <rob@...dley.net>
>---
>
> fs/nfs/super.c |   18 +++++++++++++-----
> 1 file changed, 13 insertions(+), 5 deletions(-)
>
>diff --git a/fs/nfs/super.c b/fs/nfs/super.c
>index 2137e02..863585d 100644
>--- a/fs/nfs/super.c
>+++ b/fs/nfs/super.c
>@@ -2130,11 +2130,23 @@ static int nfs_validate_text_mount_data(void *options,
> 	int port = 0;
> 	int max_namelen = PAGE_SIZE;
> 	int max_pathlen = NFS_MAXPATHLEN;
>+	int rc;
> 	struct sockaddr *sap = (struct sockaddr *)&args->nfs_server.address;
> 
> 	if (nfs_parse_mount_options((char *)options, args) == 0)
> 		return -EINVAL;
> 
>+	rc = nfs_parse_devname(dev_name,
>+				   &args->nfs_server.hostname,
>+				   max_namelen,
>+				   &args->nfs_server.export_path,
>+				   max_pathlen);
>+
>+	args->nfs_server.addrlen = rpc_pton(args->net,
>+			args->nfs_server.hostname,
>+			strlen(args->nfs_server.hostname),
>+			sap, sizeof(args->nfs_server.address));
>+

That will scribble over the parsed address.

Trond