NFSv4.1: Make sure nfsd can decode SP4_SSV correctly at exchange_id

According to RFC, the argument of ssv_sp_parms4 is:

   struct ssv_sp_parms4 {
           state_protect_ops4      ssp_ops;
           sec_oid4                ssp_hash_algs<>;
           sec_oid4                ssp_encr_algs<>;
           uint32_t                ssp_window;
           uint32_t                ssp_num_gss_handles;
   };

If client send a exchange_id with SP4_SSV, server cann't decode
the SP4_SSV's ssp_hash_algs and ssp_encr_algs arguments correctly.

Because the kernel treat the two arguments as a signal
sec_oid4 struct, but should be a set of sec_oid4 struct.

Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index f35a94a0402677d36193c9fcb57992edcc061e9d..71d7d339e44a57b070a783b0d200b7da3c79d0a6 100644 (file)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1005,7 +1005,7 @@ static __be32
 nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
                         struct nfsd4_exchange_id *exid)
 {
-       int dummy;
+       int dummy, tmp;
        DECODE_HEAD;
 
        READ_BUF(NFS4_VERIFIER_SIZE);
@@ -1053,15 +1053,23 @@ nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
 
                /* ssp_hash_algs<> */
                READ_BUF(4);
-               READ32(dummy);
-               READ_BUF(dummy);
-               p += XDR_QUADLEN(dummy);
+               READ32(tmp);
+               while (tmp--) {
+                       READ_BUF(4);
+                       READ32(dummy);
+                       READ_BUF(dummy);
+                       p += XDR_QUADLEN(dummy);
+               }
 
                /* ssp_encr_algs<> */
                READ_BUF(4);
-               READ32(dummy);
-               READ_BUF(dummy);
-               p += XDR_QUADLEN(dummy);
+               READ32(tmp);
+               while (tmp--) {
+                       READ_BUF(4);
+                       READ32(dummy);
+                       READ_BUF(dummy);
+                       p += XDR_QUADLEN(dummy);
+               }
 
                /* ssp_window and ssp_num_gss_handles */
                READ_BUF(8);