protect against malicious clients

SCCS-vsn: sys/nfs/nfs_serv.c 7.65

diff --git a/usr/src/sys/nfs/nfs_serv.c b/usr/src/sys/nfs/nfs_serv.c
index 320056b..79860a6 100644 (file)
--- a/usr/src/sys/nfs/nfs_serv.c
+++ b/usr/src/sys/nfs/nfs_serv.c
@@ -7,7 +7,7 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)nfs_serv.c  7.64 (Berkeley) %G%
+ *     @(#)nfs_serv.c  7.65 (Berkeley) %G%

  */
 
 /*
  */
 
 /*


@@ -430,6 +430,11 @@ nfsrv_read(nfsd, mrep, md, dpos, cred, nam, mrq)
        nfsm_srvstrsiz(cnt, NFS_MAXDATA);
        if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
                nfsm_reply(0);
        nfsm_srvstrsiz(cnt, NFS_MAXDATA);
        if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
                nfsm_reply(0);

+       if (vp->v_type != VREG) {
+               error = (vp->v_type == VDIR) ? EISDIR : EACCES;
+               vput(vp);
+               nfsm_reply(0);
+       }

        nqsrv_getl(vp, NQL_READ);
        if ((error = nfsrv_access(vp, VREAD, cred, rdonly, nfsd->nd_procp)) &&
            (error = nfsrv_access(vp, VEXEC, cred, rdonly, nfsd->nd_procp))) {
        nqsrv_getl(vp, NQL_READ);
        if ((error = nfsrv_access(vp, VREAD, cred, rdonly, nfsd->nd_procp)) &&
            (error = nfsrv_access(vp, VEXEC, cred, rdonly, nfsd->nd_procp))) {


@@ -564,6 +569,11 @@ nfsrv_write(nfsd, mrep, md, dpos, cred, nam, mrq)
        }
        if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
                nfsm_reply(0);
        }
        if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
                nfsm_reply(0);

+       if (vp->v_type != VREG) {
+               error = (vp->v_type == VDIR) ? EISDIR : EACCES;
+               vput(vp);
+               nfsm_reply(0);
+       }

        nqsrv_getl(vp, NQL_WRITE);
        if (error = nfsrv_access(vp, VWRITE, cred, rdonly, nfsd->nd_procp)) {
                vput(vp);
        nqsrv_getl(vp, NQL_WRITE);
        if (error = nfsrv_access(vp, VWRITE, cred, rdonly, nfsd->nd_procp)) {
                vput(vp);