From: Greg Kroah-Hartman Date: Thu, 21 Jan 2021 13:32:52 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.253~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2fbef3a94e4fe523ecf1d5fefa25cce5609d4781;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch --- diff --git a/queue-4.9/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch b/queue-4.9/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch new file mode 100644 index 00000000000..1bf745f0c3a --- /dev/null +++ b/queue-4.9/nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch @@ -0,0 +1,52 @@ +From 51b2ee7d006a736a9126e8111d1f24e4fd0afaa6 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Mon, 11 Jan 2021 16:01:29 -0500 +Subject: nfsd4: readdirplus shouldn't return parent of export + +From: J. Bruce Fields + +commit 51b2ee7d006a736a9126e8111d1f24e4fd0afaa6 upstream. + +If you export a subdirectory of a filesystem, a READDIRPLUS on the root +of that export will return the filehandle of the parent with the ".." +entry. + +The filehandle is optional, so let's just not return the filehandle for +".." if we're at the root of an export. + +Note that once the client learns one filehandle outside of the export, +they can trivially access the rest of the export using further lookups. + +However, it is also not very difficult to guess filehandles outside of +the export. So exporting a subdirectory of a filesystem should +considered equivalent to providing access to the entire filesystem. To +avoid confusion, we recommend only exporting entire filesystems. + +Reported-by: Youjipeng +Signed-off-by: J. Bruce Fields +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs3xdr.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/nfs3xdr.c ++++ b/fs/nfsd/nfs3xdr.c +@@ -822,9 +822,14 @@ compose_entry_fh(struct nfsd3_readdirres + if (isdotent(name, namlen)) { + if (namlen == 2) { + dchild = dget_parent(dparent); +- /* filesystem root - cannot return filehandle for ".." */ ++ /* ++ * Don't return filehandle for ".." if we're at ++ * the filesystem or export root: ++ */ + if (dchild == dparent) + goto out; ++ if (dparent == exp->ex_path.dentry) ++ goto out; + } else + dchild = dget(dparent); + } else diff --git a/queue-4.9/series b/queue-4.9/series index f215617632c..10cb85d5d36 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -22,3 +22,4 @@ net-sunrpc-interpret-the-return-value-of-kstrtou32-correctly.patch netfilter-conntrack-fix-reading-nf_conntrack_buckets.patch usb-ohci-make-distrust_firmware-param-default-to-false.patch compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch +nfsd4-readdirplus-shouldn-t-return-parent-of-export.patch