summaryrefslogtreecommitdiffstats
path: root/fs/nfsd/state.h
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2017-10-17 20:38:49 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-02-12 19:46:14 +0100
commitff371bc83b1cfa868bebdd7a4164a26d47e7c023 (patch)
tree5cfaef601050098513f352cd8b715ddbf7e15fae /fs/nfsd/state.h
parente74cfcb89e8f306da93230c373e4a667d670538c (diff)
downloadlinux-stable-ff371bc83b1cfa868bebdd7a4164a26d47e7c023.tar.gz
linux-stable-ff371bc83b1cfa868bebdd7a4164a26d47e7c023.tar.bz2
linux-stable-ff371bc83b1cfa868bebdd7a4164a26d47e7c023.zip
nfsd4: catch some false session retries
commit 53da6a53e1d414e05759fa59b7032ee08f4e22d7 upstream. The spec allows us to return NFS4ERR_SEQ_FALSE_RETRY if we notice that the client is making a call that matches a previous (slot, seqid) pair but that *isn't* actually a replay, because some detail of the call doesn't actually match the previous one. Catching every such case is difficult, but we may as well catch a few easy ones. This also handles the case described in the previous patch, in a different way. The spec does however require us to catch the case where the difference is in the rpc credentials. This prevents somebody from snooping another user's replies by fabricating retries. (But the practical value of the attack is limited by the fact that the replies with the most sensitive data are READ replies, which are not normally cached.) Tested-by: Olga Kornievskaia <aglo@umich.edu> Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Donald Buczek <buczek@molgen.mpg.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/nfsd/state.h')
-rw-r--r--fs/nfsd/state.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 2488b7df1b35..86aa92d200e1 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -169,6 +169,7 @@ static inline struct nfs4_delegation *delegstateid(struct nfs4_stid *s)
struct nfsd4_slot {
u32 sl_seqid;
__be32 sl_status;
+ struct svc_cred sl_cred;
u32 sl_datalen;
u16 sl_opcnt;
#define NFSD4_SLOT_INUSE (1 << 0)