protocol: don't use alloca

current implementation of alloca can cause issues when strings larger
than the allocated buffer is passed to the xdr. Hence it makes sense
to allow XDR decode functions to deal with memory allocations, which
we can free later.

BUG: 1625654
Change-Id: I3a05553f5702de9575c244649ca0e5ac9abaac94
Signed-off-by: Amar Tumballi <amarts@redhat.com>

1 files changed, 30 insertions, 47 deletions

diff --git a/xlators/protocol/server/src/server-rpc-fops.c b/xlators/protocol/server/src/server-rpc-fops.c
index 4c983399937..be05b255bb7 100644
--- a/xlators/protocol/server/src/server-rpc-fops.c
+++ b/xlators/protocol/server/src/server-rpc-fops.c
@@ -3895,8 +3895,6 @@ server3_3_create (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.bname = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_create_req, GF_FOP_CREATE);
         if (ret != 0) {
@@ -3930,6 +3928,7 @@ server3_3_create (rpcsvc_request_t *req)
 out:
         /* memory allocated by libc, don't use GF_FREE */
         free (args.xdata.xdata_val);
+        free (args.bname);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4452,8 +4451,6 @@ server3_3_unlink (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.bname = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_unlink_req, GF_FOP_UNLINK);
         if (ret != 0) {
@@ -4478,6 +4475,7 @@ server3_3_unlink (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_unlink_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.bname);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4499,8 +4497,6 @@ server3_3_setxattr (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.dict.dict_val = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_setxattr_req, GF_FOP_SETXATTR);
         if (ret != 0) {
@@ -4536,6 +4532,7 @@ server3_3_setxattr (rpcsvc_request_t *req)
 
 out:
         free (args.xdata.xdata_val);
+        free (args.dict.dict_val);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4561,8 +4558,6 @@ server3_3_fsetxattr (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.dict.dict_val = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_fsetxattr_req, GF_FOP_FSETXATTR);
         if (ret != 0) {
@@ -4596,6 +4591,7 @@ server3_3_fsetxattr (rpcsvc_request_t *req)
 
 out:
         free (args.xdata.xdata_val);
+        free (args.dict.dict_val);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4621,8 +4617,6 @@ server3_3_fxattrop (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.dict.dict_val = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_fxattrop_req, GF_FOP_FXATTROP);
         if (ret != 0) {
@@ -4656,6 +4650,7 @@ server3_3_fxattrop (rpcsvc_request_t *req)
 
 out:
         free (args.xdata.xdata_val);
+        free (args.dict.dict_val);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4681,8 +4676,6 @@ server3_3_xattrop (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.dict.dict_val = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_xattrop_req, GF_FOP_XATTROP);
         if (ret != 0) {
@@ -4715,6 +4708,7 @@ server3_3_xattrop (rpcsvc_request_t *req)
 
 out:
         free (args.xdata.xdata_val);
+        free (args.dict.dict_val);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4738,8 +4732,6 @@ server3_3_getxattr (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.name = alloca (256);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_getxattr_req, GF_FOP_GETXATTR);
         if (ret != 0) {
@@ -4765,6 +4757,7 @@ server3_3_getxattr (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_getxattr_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.name);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4785,8 +4778,6 @@ server3_3_fgetxattr (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.name = alloca (256);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_fgetxattr_req, GF_FOP_FGETXATTR);
         if (ret != 0) {
@@ -4809,6 +4800,7 @@ server3_3_fgetxattr (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_fgetxattr_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.name);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4830,8 +4822,6 @@ server3_3_removexattr (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.name = alloca (256);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_removexattr_req,
                                   GF_FOP_REMOVEXATTR);
@@ -4853,6 +4843,7 @@ server3_3_removexattr (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_removexattr_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.name);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -4872,8 +4863,6 @@ server3_3_fremovexattr (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.name = alloca (4096);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_fremovexattr_req,
                                   GF_FOP_FREMOVEXATTR);
@@ -4896,6 +4885,7 @@ server3_3_fremovexattr (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_fremovexattr_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.name);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -5106,8 +5096,6 @@ server3_3_mknod (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.bname = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_mknod_req, GF_FOP_MKNOD);
         if (ret != 0) {
@@ -5139,6 +5127,7 @@ out:
 
         /* memory allocated by libc, don't use GF_FREE */
         free (args.xdata.xdata_val);
+        free (args.bname);
 
         return ret;
 
@@ -5157,8 +5146,6 @@ server3_3_mkdir (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.bname = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_mkdir_req, GF_FOP_MKDIR);
         if (ret != 0) {
@@ -5188,6 +5175,7 @@ out:
                 SERVER_REQ_SET_ERROR (req, ret);
 
         free (args.xdata.xdata_val);
+        free (args.bname);
 
         return ret;
 }
@@ -5205,8 +5193,6 @@ server3_3_rmdir (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.bname = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_rmdir_req, GF_FOP_RMDIR);
         if (ret != 0) {
@@ -5230,6 +5216,7 @@ server3_3_rmdir (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_rmdir_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.bname);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -5252,8 +5239,6 @@ server3_3_inodelk (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.volume = alloca (256);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_inodelk_req, GF_FOP_INODELK);
         if (ret != 0) {
@@ -5303,6 +5288,7 @@ server3_3_inodelk (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_inodelk_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.volume);
 
         free (args.flock.lk_owner.lk_owner_val);
 
@@ -5324,8 +5310,6 @@ server3_3_finodelk (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.volume = alloca (256);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_finodelk_req,
                                   GF_FOP_FINODELK);
@@ -5377,6 +5361,7 @@ server3_3_finodelk (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_finodelk_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.volume);
 
         free (args.flock.lk_owner.lk_owner_val);
 
@@ -5399,9 +5384,6 @@ server3_3_entrylk (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.volume = alloca (256);
-        args.name   = alloca (256);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_entrylk_req,
                                   GF_FOP_ENTRYLK);
@@ -5429,6 +5411,8 @@ server3_3_entrylk (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_entrylk_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.volume);
+        free (args.name);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -5448,9 +5432,6 @@ server3_3_fentrylk (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.name   = alloca (256);
-        args.volume = alloca (256);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_fentrylk_req,
                                   GF_FOP_FENTRYLK);
@@ -5478,6 +5459,8 @@ server3_3_fentrylk (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_fentrylk_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.volume);
+        free (args.name);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -5538,9 +5521,6 @@ server3_3_symlink (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.bname    = alloca (req->msg[0].iov_len);
-        args.linkname = alloca (4096);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_symlink_req, GF_FOP_SYMLINK);
         if (ret != 0) {
@@ -5569,6 +5549,8 @@ out:
 
         /* memory allocated by libc, don't use GF_FREE */
         free (args.xdata.xdata_val);
+        free (args.linkname);
+        free (args.bname);
 
         return ret;
 }
@@ -5587,8 +5569,6 @@ server3_3_link (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.newbname = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_link_req, GF_FOP_LINK);
         if (ret != 0) {
@@ -5613,6 +5593,7 @@ server3_3_link (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_link_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.newbname);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -5633,9 +5614,6 @@ server3_3_rename (rpcsvc_request_t *req)
         if (!req)
                 return ret;
 
-        args.oldbname = alloca (req->msg[0].iov_len);
-        args.newbname = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_rename_req, GF_FOP_RENAME);
         if (ret != 0) {
@@ -5662,6 +5640,8 @@ server3_3_rename (rpcsvc_request_t *req)
         resolve_and_resume (frame, server_rename_resume);
 out:
         free (args.xdata.xdata_val);
+        free (args.newbname);
+        free (args.oldbname);
 
         if (op_errno)
                 SERVER_REQ_SET_ERROR (req, ret);
@@ -5864,9 +5844,6 @@ server3_3_lookup (rpcsvc_request_t *req)
 
         GF_VALIDATE_OR_GOTO ("server", req, err);
 
-        args.bname           = alloca (req->msg[0].iov_len);
-        args.xdata.xdata_val = alloca (req->msg[0].iov_len);
-
         ret = rpc_receive_common (req, &frame, &state, NULL, &args,
                                   xdr_gfs3_lookup_req, GF_FOP_LOOKUP);
         if (ret != 0) {
@@ -5893,8 +5870,14 @@ server3_3_lookup (rpcsvc_request_t *req)
         ret = 0;
         resolve_and_resume (frame, server_lookup_resume);
 
+        free (args.bname);
+        free (args.xdata.xdata_val);
+
         return ret;
 out:
+        free (args.bname);
+        free (args.xdata.xdata_val);
+
         server_lookup_cbk (frame, NULL, frame->this, -1, EINVAL, NULL, NULL,
                            NULL, NULL);
 	ret = 0;