Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

afs: Fix the CB.ProbeUuid service handler to reply correctly

Fix the service handler function for the CB.ProbeUuid RPC call so that it
replies in the correct manner - that is an empty reply for success and an
abort of 1 for failure.

Putting 0 or 1 in an integer in the body of the reply should result in the
fileserver throwing an RX_PROTOCOL_ERROR abort and discarding its record of
the client; older servers, however, don't necessarily check that all the
data got consumed, and so might incorrectly think that they got a positive
response and associate the client with the wrong host record.

If the client is incorrectly associated, this will result in callbacks
intended for a different client being delivered to this one and then, when
the other client connects and responds positively, all of the callback
promises meant for the client that issued the improper response will be
lost and it won't receive any further change notifications.

Fixes: 9396d496d745 ("afs: support the CB.ProbeUuid RPC op")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>

+3 -7
+3 -7
fs/afs/cmservice.c
··· 505 505 struct afs_call *call = container_of(work, struct afs_call, work); 506 506 struct afs_uuid *r = call->request; 507 507 508 - struct { 509 - __be32 match; 510 - } reply; 511 - 512 508 _enter(""); 513 509 514 510 if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0) 515 - reply.match = htonl(0); 511 + afs_send_empty_reply(call); 516 512 else 517 - reply.match = htonl(1); 513 + rxrpc_kernel_abort_call(call->net->socket, call->rxcall, 514 + 1, 1, "K-1"); 518 515 519 - afs_send_simple_reply(call, &reply, sizeof(reply)); 520 516 afs_put_call(call); 521 517 _leave(""); 522 518 }