Re: [PATCH] nfsd4: ensure cm_xid does not change across userspace fetches

2017-09-27 Thread J. Bruce Fields
On Tue, Sep 26, 2017 at 05:52:16PM -0400, J. Bruce Fields wrote: > On Sun, Sep 24, 2017 at 12:59:40PM -0400, Meng Xu wrote: > > cld_pipe_downcall() has two fetches from an overapped userspace memory. > > The first fetch copy_from_user(&xid, &cmsg->cm_xid, sizeof(xid)) get > > the xid and use xid to

Re: [PATCH] nfsd4: ensure cm_xid does not change across userspace fetches

2017-09-26 Thread J. Bruce Fields
On Sun, Sep 24, 2017 at 12:59:40PM -0400, Meng Xu wrote: > cld_pipe_downcall() has two fetches from an overapped userspace memory. > The first fetch copy_from_user(&xid, &cmsg->cm_xid, sizeof(xid)) get > the xid and use xid to lookup the parent struct cld_upcall *cup. > The second fetch copy_from_u

[PATCH] nfsd4: ensure cm_xid does not change across userspace fetches

2017-09-24 Thread Meng Xu
cld_pipe_downcall() has two fetches from an overapped userspace memory. The first fetch copy_from_user(&xid, &cmsg->cm_xid, sizeof(xid)) get the xid and use xid to lookup the parent struct cld_upcall *cup. The second fetch copy_from_user(&cup->cu_msg, src, mlen) place the whole message into &cup->c