RPC: Fix double free in portmapper code
[linux-2.6-block.git] / net / sunrpc / pmap_clnt.c
CommitLineData
1da177e4 1/*
c4a5692f 2 * linux/net/sunrpc/pmap_clnt.c
1da177e4 3 *
c4a5692f
CL
4 * In-kernel RPC portmapper client.
5 *
6 * Portmapper supports version 2 of the rpcbind protocol (RFC 1833).
1da177e4
LT
7 *
8 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
9 */
10
1da177e4
LT
11#include <linux/types.h>
12#include <linux/socket.h>
13#include <linux/kernel.h>
14#include <linux/errno.h>
15#include <linux/uio.h>
16#include <linux/in.h>
17#include <linux/sunrpc/clnt.h>
1da177e4
LT
18#include <linux/sunrpc/sched.h>
19
20#ifdef RPC_DEBUG
21# define RPCDBG_FACILITY RPCDBG_PMAP
22#endif
23
24#define PMAP_SET 1
25#define PMAP_UNSET 2
26#define PMAP_GETPORT 3
27
4a68179d
CL
28struct portmap_args {
29 u32 pm_prog;
30 u32 pm_vers;
31 u32 pm_prot;
32 unsigned short pm_port;
762d4527 33 struct rpc_xprt * pm_xprt;
4a68179d
CL
34};
35
1da177e4 36static struct rpc_procinfo pmap_procedures[];
6cd7525a 37static struct rpc_clnt * pmap_create(char *, struct sockaddr_in *, int, int);
4a68179d 38static void pmap_getport_done(struct rpc_task *, void *);
1da177e4 39static struct rpc_program pmap_program;
4a68179d
CL
40
41static void pmap_getport_prepare(struct rpc_task *task, void *calldata)
42{
43 struct portmap_args *map = calldata;
44 struct rpc_message msg = {
45 .rpc_proc = &pmap_procedures[PMAP_GETPORT],
46 .rpc_argp = map,
47 .rpc_resp = &map->pm_port,
48 };
49
50 rpc_call_setup(task, &msg, 0);
51}
52
53static inline struct portmap_args *pmap_map_alloc(void)
54{
55 return kmalloc(sizeof(struct portmap_args), GFP_NOFS);
56}
57
58static inline void pmap_map_free(struct portmap_args *map)
59{
60 kfree(map);
61}
62
63static void pmap_map_release(void *data)
64{
54cc533a
TM
65 struct portmap_args *map = data;
66
67 xprt_put(map->pm_xprt);
68 pmap_map_free(map);
4a68179d
CL
69}
70
71static const struct rpc_call_ops pmap_getport_ops = {
72 .rpc_call_prepare = pmap_getport_prepare,
73 .rpc_call_done = pmap_getport_done,
74 .rpc_release = pmap_map_release,
75};
76
762d4527 77static inline void pmap_wake_portmap_waiters(struct rpc_xprt *xprt, int status)
4a68179d
CL
78{
79 xprt_clear_binding(xprt);
762d4527 80 rpc_wake_up_status(&xprt->binding, status);
4a68179d 81}
1da177e4 82
c4a5692f
CL
83/**
84 * rpc_getport - obtain the port for a given RPC service on a given host
85 * @task: task that is waiting for portmapper request
c4a5692f
CL
86 *
87 * This one can be called for an ongoing RPC request, and can be used in
88 * an async (rpciod) context.
1da177e4 89 */
bbf7c1dd 90void rpc_getport(struct rpc_task *task)
1da177e4 91{
bbf7c1dd 92 struct rpc_clnt *clnt = task->tk_client;
4a68179d 93 struct rpc_xprt *xprt = task->tk_xprt;
081f79a9 94 struct sockaddr_in addr;
4a68179d 95 struct portmap_args *map;
1da177e4 96 struct rpc_clnt *pmap_clnt;
4a68179d 97 struct rpc_task *child;
762d4527 98 int status;
1da177e4 99
4a68179d 100 dprintk("RPC: %4d rpc_getport(%s, %u, %u, %d)\n",
1da177e4 101 task->tk_pid, clnt->cl_server,
4a68179d 102 clnt->cl_prog, clnt->cl_vers, xprt->prot);
1da177e4 103
007e251f
AG
104 /* Autobind on cloned rpc clients is discouraged */
105 BUG_ON(clnt->cl_parent != clnt);
106
2b577f1f
CL
107 status = -EACCES; /* tell caller to check again */
108 if (xprt_test_and_set_binding(xprt))
109 goto bailout_nowake;
110
71bdcf80
CL
111 /* Put self on queue before sending rpcbind request, in case
112 * pmap_getport_done completes before we return from rpc_run_task */
113 rpc_sleep_on(&xprt->binding, task, NULL, NULL);
114
4a68179d 115 /* Someone else may have bound if we slept */
762d4527
TM
116 status = 0;
117 if (xprt_bound(xprt))
4a68179d 118 goto bailout_nofree;
4a68179d 119
762d4527 120 status = -ENOMEM;
4a68179d 121 map = pmap_map_alloc();
762d4527 122 if (!map)
4a68179d 123 goto bailout_nofree;
4a68179d
CL
124 map->pm_prog = clnt->cl_prog;
125 map->pm_vers = clnt->cl_vers;
126 map->pm_prot = xprt->prot;
127 map->pm_port = 0;
762d4527 128 map->pm_xprt = xprt_get(xprt);
1da177e4 129
081f79a9
CL
130 rpc_peeraddr(clnt, (struct sockaddr *) &addr, sizeof(addr));
131 pmap_clnt = pmap_create(clnt->cl_server, &addr, map->pm_prot, 0);
762d4527
TM
132 status = PTR_ERR(pmap_clnt);
133 if (IS_ERR(pmap_clnt))
1da177e4 134 goto bailout;
1da177e4 135
762d4527 136 status = -EIO;
4a68179d 137 child = rpc_run_task(pmap_clnt, RPC_TASK_ASYNC, &pmap_getport_ops, map);
762d4527 138 if (IS_ERR(child))
54cc533a 139 goto bailout_nofree;
e6b3c4db 140 rpc_put_task(child);
1da177e4 141
262ca07d 142 task->tk_xprt->stat.bind_count++;
1da177e4
LT
143 return;
144
145bailout:
4a68179d 146 pmap_map_free(map);
762d4527 147 xprt_put(xprt);
4a68179d 148bailout_nofree:
762d4527 149 pmap_wake_portmap_waiters(xprt, status);
2b577f1f
CL
150bailout_nowake:
151 task->tk_status = status;
1da177e4
LT
152}
153
154#ifdef CONFIG_ROOT_NFS
c4a5692f
CL
155/**
156 * rpc_getport_external - obtain the port for a given RPC service on a given host
157 * @sin: address of remote peer
158 * @prog: RPC program number to bind
159 * @vers: RPC version number to bind
160 * @prot: transport protocol to use to make this request
161 *
162 * This one is called from outside the RPC client in a synchronous task context.
163 */
164int rpc_getport_external(struct sockaddr_in *sin, __u32 prog, __u32 vers, int prot)
1da177e4 165{
4a68179d 166 struct portmap_args map = {
1da177e4
LT
167 .pm_prog = prog,
168 .pm_vers = vers,
169 .pm_prot = prot,
170 .pm_port = 0
171 };
dead28da
CL
172 struct rpc_message msg = {
173 .rpc_proc = &pmap_procedures[PMAP_GETPORT],
174 .rpc_argp = &map,
175 .rpc_resp = &map.pm_port,
176 };
1da177e4
LT
177 struct rpc_clnt *pmap_clnt;
178 char hostname[32];
179 int status;
180
c4a5692f 181 dprintk("RPC: rpc_getport_external(%u.%u.%u.%u, %u, %u, %d)\n",
1da177e4
LT
182 NIPQUAD(sin->sin_addr.s_addr), prog, vers, prot);
183
184 sprintf(hostname, "%u.%u.%u.%u", NIPQUAD(sin->sin_addr.s_addr));
6cd7525a 185 pmap_clnt = pmap_create(hostname, sin, prot, 0);
1da177e4
LT
186 if (IS_ERR(pmap_clnt))
187 return PTR_ERR(pmap_clnt);
188
189 /* Setup the call info struct */
dead28da 190 status = rpc_call_sync(pmap_clnt, &msg, 0);
1da177e4
LT
191
192 if (status >= 0) {
193 if (map.pm_port != 0)
194 return map.pm_port;
195 status = -EACCES;
196 }
197 return status;
198}
199#endif
200
c4a5692f
CL
201/*
202 * Portmapper child task invokes this callback via tk_exit.
203 */
204static void pmap_getport_done(struct rpc_task *child, void *data)
1da177e4 205{
4a68179d 206 struct portmap_args *map = data;
762d4527 207 struct rpc_xprt *xprt = map->pm_xprt;
4a68179d 208 int status = child->tk_status;
92200412 209
4a68179d
CL
210 if (status < 0) {
211 /* Portmapper not available */
ec739ef0 212 xprt->ops->set_port(xprt, 0);
4a68179d
CL
213 } else if (map->pm_port == 0) {
214 /* Requested RPC service wasn't registered */
ec739ef0 215 xprt->ops->set_port(xprt, 0);
762d4527 216 status = -EACCES;
1da177e4 217 } else {
4a68179d
CL
218 /* Succeeded */
219 xprt->ops->set_port(xprt, map->pm_port);
ec739ef0 220 xprt_set_bound(xprt);
762d4527 221 status = 0;
1da177e4 222 }
4a68179d
CL
223
224 dprintk("RPC: %4d pmap_getport_done(status %d, port %u)\n",
762d4527 225 child->tk_pid, status, map->pm_port);
4a68179d 226
762d4527 227 pmap_wake_portmap_waiters(xprt, status);
1da177e4
LT
228}
229
c4a5692f
CL
230/**
231 * rpc_register - set or unset a port registration with the local portmapper
232 * @prog: RPC program number to bind
233 * @vers: RPC version number to bind
234 * @prot: transport protocol to use to make this request
235 * @port: port value to register
236 * @okay: result code
237 *
1da177e4
LT
238 * port == 0 means unregister, port != 0 means register.
239 */
c4a5692f 240int rpc_register(u32 prog, u32 vers, int prot, unsigned short port, int *okay)
1da177e4 241{
dead28da
CL
242 struct sockaddr_in sin = {
243 .sin_family = AF_INET,
244 .sin_addr.s_addr = htonl(INADDR_LOOPBACK),
245 };
4a68179d 246 struct portmap_args map = {
dead28da
CL
247 .pm_prog = prog,
248 .pm_vers = vers,
249 .pm_prot = prot,
250 .pm_port = port,
251 };
252 struct rpc_message msg = {
253 .rpc_proc = &pmap_procedures[port ? PMAP_SET : PMAP_UNSET],
254 .rpc_argp = &map,
255 .rpc_resp = okay,
256 };
1da177e4
LT
257 struct rpc_clnt *pmap_clnt;
258 int error = 0;
259
c4a5692f 260 dprintk("RPC: registering (%u, %u, %d, %u) with portmapper.\n",
1da177e4
LT
261 prog, vers, prot, port);
262
6cd7525a 263 pmap_clnt = pmap_create("localhost", &sin, IPPROTO_UDP, 1);
1da177e4
LT
264 if (IS_ERR(pmap_clnt)) {
265 error = PTR_ERR(pmap_clnt);
266 dprintk("RPC: couldn't create pmap client. Error = %d\n", error);
267 return error;
268 }
269
dead28da 270 error = rpc_call_sync(pmap_clnt, &msg, 0);
1da177e4
LT
271
272 if (error < 0) {
273 printk(KERN_WARNING
274 "RPC: failed to contact portmap (errno %d).\n",
275 error);
276 }
277 dprintk("RPC: registration status %d/%d\n", error, *okay);
278
279 /* Client deleted automatically because cl_oneshot == 1 */
280 return error;
281}
282
c4a5692f 283static struct rpc_clnt *pmap_create(char *hostname, struct sockaddr_in *srvaddr, int proto, int privileged)
1da177e4 284{
9e1968c5
CL
285 struct rpc_create_args args = {
286 .protocol = proto,
287 .address = (struct sockaddr *)srvaddr,
288 .addrsize = sizeof(*srvaddr),
289 .servername = hostname,
290 .program = &pmap_program,
291 .version = RPC_PMAP_VERSION,
292 .authflavor = RPC_AUTH_UNIX,
293 .flags = (RPC_CLNT_CREATE_ONESHOT |
294 RPC_CLNT_CREATE_NOPING),
295 };
296
297 srvaddr->sin_port = htons(RPC_PMAP_PORT);
6cd7525a 298 if (!privileged)
9e1968c5
CL
299 args.flags |= RPC_CLNT_CREATE_NONPRIVPORT;
300 return rpc_create(&args);
1da177e4
LT
301}
302
303/*
304 * XDR encode/decode functions for PMAP
305 */
d8ed029d 306static int xdr_encode_mapping(struct rpc_rqst *req, __be32 *p, struct portmap_args *map)
1da177e4 307{
c4a5692f 308 dprintk("RPC: xdr_encode_mapping(%u, %u, %u, %u)\n",
1da177e4
LT
309 map->pm_prog, map->pm_vers, map->pm_prot, map->pm_port);
310 *p++ = htonl(map->pm_prog);
311 *p++ = htonl(map->pm_vers);
312 *p++ = htonl(map->pm_prot);
313 *p++ = htonl(map->pm_port);
314
315 req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
316 return 0;
317}
318
d8ed029d 319static int xdr_decode_port(struct rpc_rqst *req, __be32 *p, unsigned short *portp)
1da177e4
LT
320{
321 *portp = (unsigned short) ntohl(*p++);
322 return 0;
323}
324
d8ed029d 325static int xdr_decode_bool(struct rpc_rqst *req, __be32 *p, unsigned int *boolp)
1da177e4
LT
326{
327 *boolp = (unsigned int) ntohl(*p++);
328 return 0;
329}
330
331static struct rpc_procinfo pmap_procedures[] = {
332[PMAP_SET] = {
333 .p_proc = PMAP_SET,
334 .p_encode = (kxdrproc_t) xdr_encode_mapping,
335 .p_decode = (kxdrproc_t) xdr_decode_bool,
336 .p_bufsiz = 4,
337 .p_count = 1,
cc0175c1
CL
338 .p_statidx = PMAP_SET,
339 .p_name = "SET",
1da177e4
LT
340 },
341[PMAP_UNSET] = {
342 .p_proc = PMAP_UNSET,
343 .p_encode = (kxdrproc_t) xdr_encode_mapping,
344 .p_decode = (kxdrproc_t) xdr_decode_bool,
345 .p_bufsiz = 4,
346 .p_count = 1,
cc0175c1
CL
347 .p_statidx = PMAP_UNSET,
348 .p_name = "UNSET",
1da177e4
LT
349 },
350[PMAP_GETPORT] = {
351 .p_proc = PMAP_GETPORT,
352 .p_encode = (kxdrproc_t) xdr_encode_mapping,
353 .p_decode = (kxdrproc_t) xdr_decode_port,
354 .p_bufsiz = 4,
355 .p_count = 1,
cc0175c1
CL
356 .p_statidx = PMAP_GETPORT,
357 .p_name = "GETPORT",
1da177e4
LT
358 },
359};
360
361static struct rpc_version pmap_version2 = {
362 .number = 2,
363 .nrprocs = 4,
364 .procs = pmap_procedures
365};
366
367static struct rpc_version * pmap_version[] = {
368 NULL,
369 NULL,
370 &pmap_version2
371};
372
373static struct rpc_stat pmap_stats;
374
375static struct rpc_program pmap_program = {
376 .name = "portmap",
377 .number = RPC_PMAP_PROGRAM,
378 .nrvers = ARRAY_SIZE(pmap_version),
379 .version = pmap_version,
380 .stats = &pmap_stats,
381};