diff options
Diffstat (limited to 'recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch')
-rw-r--r-- | recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch | 400 |
1 files changed, 0 insertions, 400 deletions
diff --git a/recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch b/recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch deleted file mode 100644 index bd45437c..00000000 --- a/recipes-extended/glusterfs/files/0007-protocol-don-t-use-alloca.patch +++ /dev/null @@ -1,400 +0,0 @@ -From 7d8d9bd27f245739a6f297e4ecfc87b90c783987 Mon Sep 17 00:00:00 2001 -From: Chen Qi <Qi.Chen@windriver.com> -Date: Wed, 26 Sep 2018 09:47:28 +0800 -Subject: [PATCH 7/7] protocol: don't use alloca - -current implementation of alloca can cause issues when strings larger -than the allocated buffer is passed to the xdr. Hence it makes sense -to allow XDR decode functions to deal with memory allocations, which -we can free later. - -Fixes: bz#1625097 - -Change-Id: I3a05553f5702de9575c244649ca0e5ac9abaac94 -Signed-off-by: Amar Tumballi <amarts@redhat.com> - -Upstream-Status: Backport - -Fix CVE-2018-10907 - -Signed-off-by: Chen Qi <Qi.Chen@windriver.com> ---- - xlators/protocol/server/src/server-rpc-fops.c | 73 +++++++++++---------------- - 1 file changed, 30 insertions(+), 43 deletions(-) - -diff --git a/xlators/protocol/server/src/server-rpc-fops.c b/xlators/protocol/server/src/server-rpc-fops.c -index 0ba4ffa..d3a44fc 100644 ---- a/xlators/protocol/server/src/server-rpc-fops.c -+++ b/xlators/protocol/server/src/server-rpc-fops.c -@@ -3983,8 +3983,6 @@ server3_3_create (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.bname = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_create_req); - if (ret < 0) { -@@ -4034,6 +4032,7 @@ server3_3_create (rpcsvc_request_t *req) - out: - /* memory allocated by libc, don't use GF_FREE */ - free (args.xdata.xdata_val); -+ free (args.bname); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -4693,8 +4692,6 @@ server3_3_unlink (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.bname = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_unlink_req); - if (ret < 0) { -@@ -4734,6 +4731,7 @@ server3_3_unlink (rpcsvc_request_t *req) - resolve_and_resume (frame, server_unlink_resume); - out: - free (args.xdata.xdata_val); -+ free (args.bname); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -4755,8 +4753,6 @@ server3_3_setxattr (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.dict.dict_val = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_setxattr_req); - if (ret < 0) { -@@ -4809,6 +4805,7 @@ server3_3_setxattr (rpcsvc_request_t *req) - - out: - free (args.xdata.xdata_val); -+ free (args.dict.dict_val); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -4834,7 +4831,6 @@ server3_3_fsetxattr (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.dict.dict_val = alloca (req->msg[0].iov_len); - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_fsetxattr_req); - if (ret < 0) { -@@ -4885,6 +4881,7 @@ server3_3_fsetxattr (rpcsvc_request_t *req) - - out: - free (args.xdata.xdata_val); -+ free (args.dict.dict_val); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -4910,7 +4907,6 @@ server3_3_fxattrop (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.dict.dict_val = alloca (req->msg[0].iov_len); - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_fxattrop_req); - if (ret < 0) { -@@ -4961,6 +4957,7 @@ server3_3_fxattrop (rpcsvc_request_t *req) - - out: - free (args.xdata.xdata_val); -+ free (args.dict.dict_val); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -4986,8 +4983,6 @@ server3_3_xattrop (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.dict.dict_val = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_xattrop_req); - if (ret < 0) { -@@ -5037,6 +5032,7 @@ server3_3_xattrop (rpcsvc_request_t *req) - - out: - free (args.xdata.xdata_val); -+ free (args.dict.dict_val); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -5060,8 +5056,6 @@ server3_3_getxattr (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.name = alloca (256); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_getxattr_req); - if (ret < 0) { -@@ -5104,6 +5098,7 @@ server3_3_getxattr (rpcsvc_request_t *req) - resolve_and_resume (frame, server_getxattr_resume); - out: - free (args.xdata.xdata_val); -+ free (args.name); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -5124,7 +5119,6 @@ server3_3_fgetxattr (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.name = alloca (256); - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_fgetxattr_req); - if (ret < 0) { -@@ -5165,6 +5159,7 @@ server3_3_fgetxattr (rpcsvc_request_t *req) - resolve_and_resume (frame, server_fgetxattr_resume); - out: - free (args.xdata.xdata_val); -+ free (args.name); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -5186,8 +5181,6 @@ server3_3_removexattr (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.name = alloca (256); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_removexattr_req); - if (ret < 0) { -@@ -5225,6 +5218,7 @@ server3_3_removexattr (rpcsvc_request_t *req) - resolve_and_resume (frame, server_removexattr_resume); - out: - free (args.xdata.xdata_val); -+ free (args.name); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -5244,8 +5238,6 @@ server3_3_fremovexattr (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.name = alloca (4096); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_fremovexattr_req); - if (ret < 0) { -@@ -5284,6 +5276,7 @@ server3_3_fremovexattr (rpcsvc_request_t *req) - resolve_and_resume (frame, server_fremovexattr_resume); - out: - free (args.xdata.xdata_val); -+ free (args.name); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -5561,8 +5554,6 @@ server3_3_mknod (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.bname = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_mknod_req); - if (ret < 0) { -@@ -5609,6 +5600,7 @@ out: - - /* memory allocated by libc, don't use GF_FREE */ - free (args.xdata.xdata_val); -+ free (args.bname); - - return ret; - -@@ -5627,8 +5619,6 @@ server3_3_mkdir (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.bname = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_mkdir_req); - if (ret < 0) { -@@ -5674,6 +5664,7 @@ out: - SERVER_REQ_SET_ERROR (req, ret); - - free (args.xdata.xdata_val); -+ free (args.bname); - - return ret; - } -@@ -5691,8 +5682,6 @@ server3_3_rmdir (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.bname = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_rmdir_req); - if (ret < 0) { -@@ -5732,6 +5721,7 @@ server3_3_rmdir (rpcsvc_request_t *req) - resolve_and_resume (frame, server_rmdir_resume); - out: - free (args.xdata.xdata_val); -+ free (args.bname); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -5754,8 +5744,6 @@ server3_3_inodelk (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.volume = alloca (256); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_inodelk_req); - if (ret < 0) { -@@ -5822,6 +5810,7 @@ server3_3_inodelk (rpcsvc_request_t *req) - resolve_and_resume (frame, server_inodelk_resume); - out: - free (args.xdata.xdata_val); -+ free (args.volume); - - free (args.flock.lk_owner.lk_owner_val); - -@@ -5843,7 +5832,6 @@ server3_3_finodelk (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.volume = alloca (256); - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_finodelk_req); - if (ret < 0) { -@@ -5911,6 +5899,7 @@ server3_3_finodelk (rpcsvc_request_t *req) - resolve_and_resume (frame, server_finodelk_resume); - out: - free (args.xdata.xdata_val); -+ free (args.volume); - - free (args.flock.lk_owner.lk_owner_val); - -@@ -5933,9 +5922,6 @@ server3_3_entrylk (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.volume = alloca (256); -- args.name = alloca (256); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_entrylk_req); - if (ret < 0) { -@@ -5979,6 +5965,8 @@ server3_3_entrylk (rpcsvc_request_t *req) - resolve_and_resume (frame, server_entrylk_resume); - out: - free (args.xdata.xdata_val); -+ free (args.volume); -+ free (args.name); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -5998,9 +5986,6 @@ server3_3_fentrylk (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.name = alloca (256); -- args.volume = alloca (256); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_fentrylk_req); - if (ret < 0) { -@@ -6044,6 +6029,8 @@ server3_3_fentrylk (rpcsvc_request_t *req) - resolve_and_resume (frame, server_fentrylk_resume); - out: - free (args.xdata.xdata_val); -+ free (args.volume); -+ free (args.name); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -6121,9 +6108,6 @@ server3_3_symlink (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.bname = alloca (req->msg[0].iov_len); -- args.linkname = alloca (4096); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_symlink_req); - if (ret < 0) { -@@ -6168,6 +6152,8 @@ out: - - /* memory allocated by libc, don't use GF_FREE */ - free (args.xdata.xdata_val); -+ free (args.linkname); -+ free (args.bname); - - return ret; - } -@@ -6186,8 +6172,6 @@ server3_3_link (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.newbname = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, (xdrproc_t)xdr_gfs3_link_req); - if (ret < 0) { - //failed to decode msg; -@@ -6227,6 +6211,7 @@ server3_3_link (rpcsvc_request_t *req) - resolve_and_resume (frame, server_link_resume); - out: - free (args.xdata.xdata_val); -+ free (args.newbname); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -6247,9 +6232,6 @@ server3_3_rename (rpcsvc_request_t *req) - if (!req) - return ret; - -- args.oldbname = alloca (req->msg[0].iov_len); -- args.newbname = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_rename_req); - if (ret < 0) { -@@ -6291,6 +6273,8 @@ server3_3_rename (rpcsvc_request_t *req) - resolve_and_resume (frame, server_rename_resume); - out: - free (args.xdata.xdata_val); -+ free (args.newbname); -+ free (args.oldbname); - - if (op_errno) - SERVER_REQ_SET_ERROR (req, ret); -@@ -6537,9 +6521,6 @@ server3_3_lookup (rpcsvc_request_t *req) - - GF_VALIDATE_OR_GOTO ("server", req, err); - -- args.bname = alloca (req->msg[0].iov_len); -- args.xdata.xdata_val = alloca (req->msg[0].iov_len); -- - ret = xdr_to_generic (req->msg[0], &args, - (xdrproc_t)xdr_gfs3_lookup_req); - if (ret < 0) { -@@ -6585,8 +6566,14 @@ server3_3_lookup (rpcsvc_request_t *req) - ret = 0; - resolve_and_resume (frame, server_lookup_resume); - -+ free (args.bname); -+ free (args.xdata.xdata_val); -+ - return ret; - out: -+ free (args.bname); -+ free (args.xdata.xdata_val); -+ - server_lookup_cbk (frame, NULL, frame->this, -1, EINVAL, NULL, NULL, - NULL, NULL); - ret = 0; --- -2.7.4 - |