mirror of
https://github.com/torvalds/linux
synced 2024-07-22 03:01:14 +00:00
020c69c1a7
UTS_RELEASE has a maximum length of 64 which can cause rxrpc_version to
exceed the 65 byte message limit.
Per the rx spec[1]: "If a server receives a packet with a type value of 13,
and the client-initiated flag set, it should respond with a 65-byte payload
containing a string that identifies the version of AFS software it is
running."
The current implementation causes a compile error when WERROR is turned on
and/or UTS_RELEASE exceeds the length of 49 (making the version string more
than 64 characters).
Fix this by generating the string during module initialisation and limiting
the UTS_RELEASE segment of the string does not exceed 49 chars. We need to
make sure that the 64 bytes includes "linux-" at the front and " AF_RXRPC"
at the back as this may be used in pattern matching.
Fixes: 44ba06987c ("RxRPC: Handle VERSION Rx protocol packets")
Reported-by: Kenny Ho <Kenny.Ho@amd.com>
Link: https://lore.kernel.org/r/20230523223944.691076-1-Kenny.Ho@amd.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Kenny Ho <Kenny.Ho@amd.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Andrew Lunn <andrew@lunn.ch>
cc: David Laight <David.Laight@ACULAB.COM>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
Link: https://web.mit.edu/kolya/afs/rx/rx-spec [1]
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Link: https://lore.kernel.org/r/654974.1685100894@warthog.procyon.org.uk
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
85 lines
2 KiB
C
85 lines
2 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/* AF_RXRPC local endpoint management
|
|
*
|
|
* Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/net.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/slab.h>
|
|
#include <net/sock.h>
|
|
#include <net/af_rxrpc.h>
|
|
#include <generated/utsrelease.h>
|
|
#include "ar-internal.h"
|
|
|
|
static char rxrpc_version_string[65]; // "linux-" UTS_RELEASE " AF_RXRPC";
|
|
|
|
/*
|
|
* Generate the VERSION packet string.
|
|
*/
|
|
void rxrpc_gen_version_string(void)
|
|
{
|
|
snprintf(rxrpc_version_string, sizeof(rxrpc_version_string),
|
|
"linux-%.49s AF_RXRPC", UTS_RELEASE);
|
|
}
|
|
|
|
/*
|
|
* Reply to a version request
|
|
*/
|
|
void rxrpc_send_version_request(struct rxrpc_local *local,
|
|
struct rxrpc_host_header *hdr,
|
|
struct sk_buff *skb)
|
|
{
|
|
struct rxrpc_wire_header whdr;
|
|
struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
|
|
struct sockaddr_rxrpc srx;
|
|
struct msghdr msg;
|
|
struct kvec iov[2];
|
|
size_t len;
|
|
int ret;
|
|
|
|
_enter("");
|
|
|
|
if (rxrpc_extract_addr_from_skb(&srx, skb) < 0)
|
|
return;
|
|
|
|
msg.msg_name = &srx.transport;
|
|
msg.msg_namelen = srx.transport_len;
|
|
msg.msg_control = NULL;
|
|
msg.msg_controllen = 0;
|
|
msg.msg_flags = 0;
|
|
|
|
whdr.epoch = htonl(sp->hdr.epoch);
|
|
whdr.cid = htonl(sp->hdr.cid);
|
|
whdr.callNumber = htonl(sp->hdr.callNumber);
|
|
whdr.seq = 0;
|
|
whdr.serial = 0;
|
|
whdr.type = RXRPC_PACKET_TYPE_VERSION;
|
|
whdr.flags = RXRPC_LAST_PACKET | (~hdr->flags & RXRPC_CLIENT_INITIATED);
|
|
whdr.userStatus = 0;
|
|
whdr.securityIndex = 0;
|
|
whdr._rsvd = 0;
|
|
whdr.serviceId = htons(sp->hdr.serviceId);
|
|
|
|
iov[0].iov_base = &whdr;
|
|
iov[0].iov_len = sizeof(whdr);
|
|
iov[1].iov_base = (char *)rxrpc_version_string;
|
|
iov[1].iov_len = sizeof(rxrpc_version_string);
|
|
|
|
len = iov[0].iov_len + iov[1].iov_len;
|
|
|
|
ret = kernel_sendmsg(local->socket, &msg, iov, 2, len);
|
|
if (ret < 0)
|
|
trace_rxrpc_tx_fail(local->debug_id, 0, ret,
|
|
rxrpc_tx_point_version_reply);
|
|
else
|
|
trace_rxrpc_tx_packet(local->debug_id, &whdr,
|
|
rxrpc_tx_point_version_reply);
|
|
|
|
_leave("");
|
|
}
|