• J. Bruce Fields's avatar
    nfsd4: recheck for secure ports in fh_verify · 6fa02839
    J. Bruce Fields authored
    As with commit 7fc90ec9 ("knfsd: nfsd:
    call nfsd_setuser() on fh_compose(), fix nfsd4 permissions problem")
    this is a case where we need to redo a security check in fh_verify()
    even though the filehandle already has an associated dentry--if the
    filehandle was created by fh_compose() in an earlier operation of the
    nfsv4 compound, then we may not have done these checks yet.
    
    Without this fix it is possible, for example, to traverse from an export
    without the secure ports requirement to one with it in a single
    compound, and bypass the secure port check on the new export.
    
    While we're here, fix up some minor style problems and change a printk()
    to a dprintk(), to make it harder for random unprivileged users to spam
    the logs.
    Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
    Reviewed-By: default avatarNeilBrown <neilb@suse.de>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    6fa02839
nfsfh.c 14.8 KB