nfsd: Add a sanity check to SecinfoNoname for file type

Robert Morris reported that, for the case of SecinfoNoname
with the Parent option, providing a non-directory could
cause a crash.

This patch adds a sanity check for v_type == VDIR for
this case, to avoid the crash.

Reported by:	rtm@lcs.mit.edu
PR:	260300
MFC after:	2 weeks

This commit is contained in:

Rick Macklem

2022-05-01 13:41:31 -07:00

parent d095d6a34c

commit 47d75c29f5

1 changed files with 5 additions and 0 deletions

									
										sys/fs/nfsserver/nfs_nfsdserv.c
									
		+5
		
												View File
												
				@@ -3822,6 +3822,11 @@ nfsrvd_secinfononame(struct nfsrv_descript *nd, int isdgram,

					fhstyle = fxdr_unsigned(int, *tl);

					switch (fhstyle) {

					case NFSSECINFONONAME_PARENT:

						if (dp->v_type != VDIR) {

							vput(dp);

							nd->nd_repstat = NFSERR_NOTDIR;

							goto nfsmout;

						}

						NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,

						    LOCKLEAF | SAVESTART);

						nfsvno_setpathbuf(&named, &bufp, &hashp);