summaryrefslogtreecommitdiffstats
path: root/recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch')
-rw-r--r--recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch400
1 files changed, 0 insertions, 400 deletions
diff --git a/recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch b/recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch
deleted file mode 100644
index bd45437..0000000
--- a/recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch
+++ /dev/null
@@ -1,400 +0,0 @@
1From 7d8d9bd27f245739a6f297e4ecfc87b90c783987 Mon Sep 17 00:00:00 2001
2From: Chen Qi <Qi.Chen@windriver.com>
3Date: Wed, 26 Sep 2018 09:47:28 +0800
4Subject: [PATCH 7/7] protocol: don't use alloca
5
6current implementation of alloca can cause issues when strings larger
7than the allocated buffer is passed to the xdr. Hence it makes sense
8to allow XDR decode functions to deal with memory allocations, which
9we can free later.
10
11Fixes: bz#1625097
12
13Change-Id: I3a05553f5702de9575c244649ca0e5ac9abaac94
14Signed-off-by: Amar Tumballi <amarts@redhat.com>
15
16Upstream-Status: Backport
17
18Fix CVE-2018-10907
19
20Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
21---
22 xlators/protocol/server/src/server-rpc-fops.c | 73 +++++++++++----------------
23 1 file changed, 30 insertions(+), 43 deletions(-)
24
25diff --git a/xlators/protocol/server/src/server-rpc-fops.c b/xlators/protocol/server/src/server-rpc-fops.c
26index 0ba4ffa..d3a44fc 100644
27--- a/xlators/protocol/server/src/server-rpc-fops.c
28+++ b/xlators/protocol/server/src/server-rpc-fops.c
29@@ -3983,8 +3983,6 @@ server3_3_create (rpcsvc_request_t *req)
30 if (!req)
31 return ret;
32
33- args.bname = alloca (req->msg[0].iov_len);
34-
35 ret = xdr_to_generic (req->msg[0], &args,
36 (xdrproc_t)xdr_gfs3_create_req);
37 if (ret < 0) {
38@@ -4034,6 +4032,7 @@ server3_3_create (rpcsvc_request_t *req)
39 out:
40 /* memory allocated by libc, don't use GF_FREE */
41 free (args.xdata.xdata_val);
42+ free (args.bname);
43
44 if (op_errno)
45 SERVER_REQ_SET_ERROR (req, ret);
46@@ -4693,8 +4692,6 @@ server3_3_unlink (rpcsvc_request_t *req)
47 if (!req)
48 return ret;
49
50- args.bname = alloca (req->msg[0].iov_len);
51-
52 ret = xdr_to_generic (req->msg[0], &args,
53 (xdrproc_t)xdr_gfs3_unlink_req);
54 if (ret < 0) {
55@@ -4734,6 +4731,7 @@ server3_3_unlink (rpcsvc_request_t *req)
56 resolve_and_resume (frame, server_unlink_resume);
57 out:
58 free (args.xdata.xdata_val);
59+ free (args.bname);
60
61 if (op_errno)
62 SERVER_REQ_SET_ERROR (req, ret);
63@@ -4755,8 +4753,6 @@ server3_3_setxattr (rpcsvc_request_t *req)
64 if (!req)
65 return ret;
66
67- args.dict.dict_val = alloca (req->msg[0].iov_len);
68-
69 ret = xdr_to_generic (req->msg[0], &args,
70 (xdrproc_t)xdr_gfs3_setxattr_req);
71 if (ret < 0) {
72@@ -4809,6 +4805,7 @@ server3_3_setxattr (rpcsvc_request_t *req)
73
74 out:
75 free (args.xdata.xdata_val);
76+ free (args.dict.dict_val);
77
78 if (op_errno)
79 SERVER_REQ_SET_ERROR (req, ret);
80@@ -4834,7 +4831,6 @@ server3_3_fsetxattr (rpcsvc_request_t *req)
81 if (!req)
82 return ret;
83
84- args.dict.dict_val = alloca (req->msg[0].iov_len);
85 ret = xdr_to_generic (req->msg[0], &args,
86 (xdrproc_t)xdr_gfs3_fsetxattr_req);
87 if (ret < 0) {
88@@ -4885,6 +4881,7 @@ server3_3_fsetxattr (rpcsvc_request_t *req)
89
90 out:
91 free (args.xdata.xdata_val);
92+ free (args.dict.dict_val);
93
94 if (op_errno)
95 SERVER_REQ_SET_ERROR (req, ret);
96@@ -4910,7 +4907,6 @@ server3_3_fxattrop (rpcsvc_request_t *req)
97 if (!req)
98 return ret;
99
100- args.dict.dict_val = alloca (req->msg[0].iov_len);
101 ret = xdr_to_generic (req->msg[0], &args,
102 (xdrproc_t)xdr_gfs3_fxattrop_req);
103 if (ret < 0) {
104@@ -4961,6 +4957,7 @@ server3_3_fxattrop (rpcsvc_request_t *req)
105
106 out:
107 free (args.xdata.xdata_val);
108+ free (args.dict.dict_val);
109
110 if (op_errno)
111 SERVER_REQ_SET_ERROR (req, ret);
112@@ -4986,8 +4983,6 @@ server3_3_xattrop (rpcsvc_request_t *req)
113 if (!req)
114 return ret;
115
116- args.dict.dict_val = alloca (req->msg[0].iov_len);
117-
118 ret = xdr_to_generic (req->msg[0], &args,
119 (xdrproc_t)xdr_gfs3_xattrop_req);
120 if (ret < 0) {
121@@ -5037,6 +5032,7 @@ server3_3_xattrop (rpcsvc_request_t *req)
122
123 out:
124 free (args.xdata.xdata_val);
125+ free (args.dict.dict_val);
126
127 if (op_errno)
128 SERVER_REQ_SET_ERROR (req, ret);
129@@ -5060,8 +5056,6 @@ server3_3_getxattr (rpcsvc_request_t *req)
130 if (!req)
131 return ret;
132
133- args.name = alloca (256);
134-
135 ret = xdr_to_generic (req->msg[0], &args,
136 (xdrproc_t)xdr_gfs3_getxattr_req);
137 if (ret < 0) {
138@@ -5104,6 +5098,7 @@ server3_3_getxattr (rpcsvc_request_t *req)
139 resolve_and_resume (frame, server_getxattr_resume);
140 out:
141 free (args.xdata.xdata_val);
142+ free (args.name);
143
144 if (op_errno)
145 SERVER_REQ_SET_ERROR (req, ret);
146@@ -5124,7 +5119,6 @@ server3_3_fgetxattr (rpcsvc_request_t *req)
147 if (!req)
148 return ret;
149
150- args.name = alloca (256);
151 ret = xdr_to_generic (req->msg[0], &args,
152 (xdrproc_t)xdr_gfs3_fgetxattr_req);
153 if (ret < 0) {
154@@ -5165,6 +5159,7 @@ server3_3_fgetxattr (rpcsvc_request_t *req)
155 resolve_and_resume (frame, server_fgetxattr_resume);
156 out:
157 free (args.xdata.xdata_val);
158+ free (args.name);
159
160 if (op_errno)
161 SERVER_REQ_SET_ERROR (req, ret);
162@@ -5186,8 +5181,6 @@ server3_3_removexattr (rpcsvc_request_t *req)
163 if (!req)
164 return ret;
165
166- args.name = alloca (256);
167-
168 ret = xdr_to_generic (req->msg[0], &args,
169 (xdrproc_t)xdr_gfs3_removexattr_req);
170 if (ret < 0) {
171@@ -5225,6 +5218,7 @@ server3_3_removexattr (rpcsvc_request_t *req)
172 resolve_and_resume (frame, server_removexattr_resume);
173 out:
174 free (args.xdata.xdata_val);
175+ free (args.name);
176
177 if (op_errno)
178 SERVER_REQ_SET_ERROR (req, ret);
179@@ -5244,8 +5238,6 @@ server3_3_fremovexattr (rpcsvc_request_t *req)
180 if (!req)
181 return ret;
182
183- args.name = alloca (4096);
184-
185 ret = xdr_to_generic (req->msg[0], &args,
186 (xdrproc_t)xdr_gfs3_fremovexattr_req);
187 if (ret < 0) {
188@@ -5284,6 +5276,7 @@ server3_3_fremovexattr (rpcsvc_request_t *req)
189 resolve_and_resume (frame, server_fremovexattr_resume);
190 out:
191 free (args.xdata.xdata_val);
192+ free (args.name);
193
194 if (op_errno)
195 SERVER_REQ_SET_ERROR (req, ret);
196@@ -5561,8 +5554,6 @@ server3_3_mknod (rpcsvc_request_t *req)
197 if (!req)
198 return ret;
199
200- args.bname = alloca (req->msg[0].iov_len);
201-
202 ret = xdr_to_generic (req->msg[0], &args,
203 (xdrproc_t)xdr_gfs3_mknod_req);
204 if (ret < 0) {
205@@ -5609,6 +5600,7 @@ out:
206
207 /* memory allocated by libc, don't use GF_FREE */
208 free (args.xdata.xdata_val);
209+ free (args.bname);
210
211 return ret;
212
213@@ -5627,8 +5619,6 @@ server3_3_mkdir (rpcsvc_request_t *req)
214 if (!req)
215 return ret;
216
217- args.bname = alloca (req->msg[0].iov_len);
218-
219 ret = xdr_to_generic (req->msg[0], &args,
220 (xdrproc_t)xdr_gfs3_mkdir_req);
221 if (ret < 0) {
222@@ -5674,6 +5664,7 @@ out:
223 SERVER_REQ_SET_ERROR (req, ret);
224
225 free (args.xdata.xdata_val);
226+ free (args.bname);
227
228 return ret;
229 }
230@@ -5691,8 +5682,6 @@ server3_3_rmdir (rpcsvc_request_t *req)
231 if (!req)
232 return ret;
233
234- args.bname = alloca (req->msg[0].iov_len);
235-
236 ret = xdr_to_generic (req->msg[0], &args,
237 (xdrproc_t)xdr_gfs3_rmdir_req);
238 if (ret < 0) {
239@@ -5732,6 +5721,7 @@ server3_3_rmdir (rpcsvc_request_t *req)
240 resolve_and_resume (frame, server_rmdir_resume);
241 out:
242 free (args.xdata.xdata_val);
243+ free (args.bname);
244
245 if (op_errno)
246 SERVER_REQ_SET_ERROR (req, ret);
247@@ -5754,8 +5744,6 @@ server3_3_inodelk (rpcsvc_request_t *req)
248 if (!req)
249 return ret;
250
251- args.volume = alloca (256);
252-
253 ret = xdr_to_generic (req->msg[0], &args,
254 (xdrproc_t)xdr_gfs3_inodelk_req);
255 if (ret < 0) {
256@@ -5822,6 +5810,7 @@ server3_3_inodelk (rpcsvc_request_t *req)
257 resolve_and_resume (frame, server_inodelk_resume);
258 out:
259 free (args.xdata.xdata_val);
260+ free (args.volume);
261
262 free (args.flock.lk_owner.lk_owner_val);
263
264@@ -5843,7 +5832,6 @@ server3_3_finodelk (rpcsvc_request_t *req)
265 if (!req)
266 return ret;
267
268- args.volume = alloca (256);
269 ret = xdr_to_generic (req->msg[0], &args,
270 (xdrproc_t)xdr_gfs3_finodelk_req);
271 if (ret < 0) {
272@@ -5911,6 +5899,7 @@ server3_3_finodelk (rpcsvc_request_t *req)
273 resolve_and_resume (frame, server_finodelk_resume);
274 out:
275 free (args.xdata.xdata_val);
276+ free (args.volume);
277
278 free (args.flock.lk_owner.lk_owner_val);
279
280@@ -5933,9 +5922,6 @@ server3_3_entrylk (rpcsvc_request_t *req)
281 if (!req)
282 return ret;
283
284- args.volume = alloca (256);
285- args.name = alloca (256);
286-
287 ret = xdr_to_generic (req->msg[0], &args,
288 (xdrproc_t)xdr_gfs3_entrylk_req);
289 if (ret < 0) {
290@@ -5979,6 +5965,8 @@ server3_3_entrylk (rpcsvc_request_t *req)
291 resolve_and_resume (frame, server_entrylk_resume);
292 out:
293 free (args.xdata.xdata_val);
294+ free (args.volume);
295+ free (args.name);
296
297 if (op_errno)
298 SERVER_REQ_SET_ERROR (req, ret);
299@@ -5998,9 +5986,6 @@ server3_3_fentrylk (rpcsvc_request_t *req)
300 if (!req)
301 return ret;
302
303- args.name = alloca (256);
304- args.volume = alloca (256);
305-
306 ret = xdr_to_generic (req->msg[0], &args,
307 (xdrproc_t)xdr_gfs3_fentrylk_req);
308 if (ret < 0) {
309@@ -6044,6 +6029,8 @@ server3_3_fentrylk (rpcsvc_request_t *req)
310 resolve_and_resume (frame, server_fentrylk_resume);
311 out:
312 free (args.xdata.xdata_val);
313+ free (args.volume);
314+ free (args.name);
315
316 if (op_errno)
317 SERVER_REQ_SET_ERROR (req, ret);
318@@ -6121,9 +6108,6 @@ server3_3_symlink (rpcsvc_request_t *req)
319 if (!req)
320 return ret;
321
322- args.bname = alloca (req->msg[0].iov_len);
323- args.linkname = alloca (4096);
324-
325 ret = xdr_to_generic (req->msg[0], &args,
326 (xdrproc_t)xdr_gfs3_symlink_req);
327 if (ret < 0) {
328@@ -6168,6 +6152,8 @@ out:
329
330 /* memory allocated by libc, don't use GF_FREE */
331 free (args.xdata.xdata_val);
332+ free (args.linkname);
333+ free (args.bname);
334
335 return ret;
336 }
337@@ -6186,8 +6172,6 @@ server3_3_link (rpcsvc_request_t *req)
338 if (!req)
339 return ret;
340
341- args.newbname = alloca (req->msg[0].iov_len);
342-
343 ret = xdr_to_generic (req->msg[0], &args, (xdrproc_t)xdr_gfs3_link_req);
344 if (ret < 0) {
345 //failed to decode msg;
346@@ -6227,6 +6211,7 @@ server3_3_link (rpcsvc_request_t *req)
347 resolve_and_resume (frame, server_link_resume);
348 out:
349 free (args.xdata.xdata_val);
350+ free (args.newbname);
351
352 if (op_errno)
353 SERVER_REQ_SET_ERROR (req, ret);
354@@ -6247,9 +6232,6 @@ server3_3_rename (rpcsvc_request_t *req)
355 if (!req)
356 return ret;
357
358- args.oldbname = alloca (req->msg[0].iov_len);
359- args.newbname = alloca (req->msg[0].iov_len);
360-
361 ret = xdr_to_generic (req->msg[0], &args,
362 (xdrproc_t)xdr_gfs3_rename_req);
363 if (ret < 0) {
364@@ -6291,6 +6273,8 @@ server3_3_rename (rpcsvc_request_t *req)
365 resolve_and_resume (frame, server_rename_resume);
366 out:
367 free (args.xdata.xdata_val);
368+ free (args.newbname);
369+ free (args.oldbname);
370
371 if (op_errno)
372 SERVER_REQ_SET_ERROR (req, ret);
373@@ -6537,9 +6521,6 @@ server3_3_lookup (rpcsvc_request_t *req)
374
375 GF_VALIDATE_OR_GOTO ("server", req, err);
376
377- args.bname = alloca (req->msg[0].iov_len);
378- args.xdata.xdata_val = alloca (req->msg[0].iov_len);
379-
380 ret = xdr_to_generic (req->msg[0], &args,
381 (xdrproc_t)xdr_gfs3_lookup_req);
382 if (ret < 0) {
383@@ -6585,8 +6566,14 @@ server3_3_lookup (rpcsvc_request_t *req)
384 ret = 0;
385 resolve_and_resume (frame, server_lookup_resume);
386
387+ free (args.bname);
388+ free (args.xdata.xdata_val);
389+
390 return ret;
391 out:
392+ free (args.bname);
393+ free (args.xdata.xdata_val);
394+
395 server_lookup_cbk (frame, NULL, frame->this, -1, EINVAL, NULL, NULL,
396 NULL, NULL);
397 ret = 0;
398--
3992.7.4
400
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 22:29:36 +0000