Patch-ID# 100173-13
Keywords: security lockf large uid mbuf leak anonymous ENOSPC truncation setuid
Synopsis: SunOS 4.1.3: NFS Jumbo Patch
Date: Feb/01/96

Solaris Release:  1.1

SunOS release:  4.1.3

NOTE:   NFS Jumbo patch support for SunOS 4.1.1 & 4.1.2 was previously
        provided in patch 100173.  Beginning with rev 100173-12, support
        for these releases has been discontinued in that patch.  The
        100173 patch will continue to only support SunOS 4.1.3.  Patch
        support for 4.1.1 & 4.1.2 releases equivalent to patch rev
        100173-10 is now available as shown in the matrix below:

	PATCH-ID		SUNOS LEVEL
	
        102177-02               4.1.3_U1
	102231-01		4.1.1 & 4.1.2

Unbundled Product:

Unbundled Release:

Relevant Architectures:  sparc

BugId's fixed with this patch: 1227246 1139620 1176647 1039977 1032959 1029628 1037476 1038302 1034328 1045536 1030884 1045993 1047557 1052330 1053679 1041409 1065361 1066287 1064433 1070654 1076985 1095935 1097593 1111816

Changes incorporated in this version: 1227246

Patches accumulated and obsoleted by this patch:

Patches which may conflict with this patch:

Obsoleted by:

Problem Description:

NOTE: This patch is compatible with Unix Unbundled product SunDBE. Please
      make sure that SunDBE  version of nfs_export.o is installed instead
      of nfs_export.o  from this patch.

BUGID: 1227246
       With the introduction of Solaris 2.5.1 as NFS server or client,
       4.1.x is exposed to a security loophole. 4.1.x does not take
       care of large uids which is used by SGI, AIX and 2.5.1 machines.

BUGID: 1139620
       If one lockf()'s a nfs file, it looks like the lock stays for
       some time

BUGID: 1176647
       Interrupting writes to NFS mounted files causes repeated but
       unpredictable error.

BUGID: 1039977
       When the kernel is built with the NFS debugging options the resulting
       kernel panics due to a bug in the nfs debugging code.

BUGID: 1032959
       A client call to NFSPROC_MKDIR causes incorrect attributes to be
       returned.

BUGID: 1029628
       When a program with the setuid bit set is copied between local files the
       setuid bit is cleared.  If the same file is copied to an nfs file system
       the setuid bit is not cleared on the new file.

BUGID: 1037476
       Sending bad procedure number to NFS server can cause mbuf leak.

BUGID: 1038302
       NFS export option "anon=-1" does not work. The user will not be allowed
       to mount the exported filesystem.

BUGID: 1034328
       An NFS client can crash if two procedures unlink the same file at once.

BUGID: 1030884
       Whenever a write to a file cannot be satisfied because the filesystem is
       filled, an ENOSPC error is returned (as expected). Subsequent to this
       error condition, any write to the file on that open descriptor also
       return ENOSPC.

BUGID: 1045536
       NFS exports to non-sun systems can allow file truncation (security
       violation).

BUGID: 1045993
       NFS attribute problem on locked files over nfs results in read error.

BUGID: 1047557
       Old pages not being purged if file gets truncated on server.

BUGID: 1052330
       Repeatedly lock, RW, and unlock an NFS file between several clients,
       can results in inconsistent file contents.

BUGID: 1053679
       File range locking of NFS files was broken in 4.x.

BUGID: 1041409 (June-3-91)
       setuid

BUGID: 1065361 (July-29-91)
       When an existing file is created again it has the wrong gid.

BUGID: 1064433 (Aug-19-91)
	Export of subtree doesn't work due to rfs_lookup not checking for ".."
        of the export point.

BUGID: 1066287 (Aug-19-91) seg_vn.c
       nfs hang when looking at large file being changed on server

BUGID: 1066287 (Nov-5-91)
       Added check for page being null that could cause a panic.

BUGID: 1070654 (Nov-5-91)
       When files are recreated, it is marked as being in use such
       that removal of the file results in a .nfsXXX file being created
       and unmount is not possible.

BUGID: 1095935
	NFS server in which a client presenting a 32-bit uid in which
	the 16 low-order bits are 0 gets interpreted as root on the server.

BUGID: 1076985
	The problem is in NFS XDR decoding of a read directory response it
	does a kmem_alloc of the requested size, but when decoding the
	response it reads in the file number and the name length before
	determining if there is sufficient space to read the name, as a
	result a panic occurs.

        Fix was made to bug introduced in the -06 fix:
	This bug was introduced when bug 1064433 was fixed in the -06 patch
	rev, although apparently no formal bug report was filed. The bug was
	that the vnode is not released when returning from an error, even
	though the vnode was successfully acquired (and held) in the
	fhtovp() call. A problem with a bug of this nature is that if
	rfs_lookup() returns without releasing the vnode then the file
	becomes un-deletable until the system is rebooted.  Rfs_lookup()
	will only return with the vnode held only if the user tries to
	cd using .. to above the exported root directory for the filesystem
	(or directory tree).

        The -07 Temp fix was taken out of NFS code an put in seg_vn.c:
	The bug below is really in seg_vn.c.  In -07 this was fixed in
	NFS code but now in -08 the proper fix has been made.

  	*BUGID: 1066287 (Aug-19-91) seg_vn.c
        nfs hang when looking at large file being changed on server

BUGID: 1097593
        Accessing NFS mounted files as root first, causes any application
        not to be able to access the same file regardless of the file permission

BUGID: 1111816
        NFS write append performance poor.  (nfs_vnodeops.o changed)


Patch Installation Instructions:

*NOTE: 4.1.3 SYSTEM
-------------------
In 4.1.3 OSor later, the seg_vn and svc_kudp fixes were integrated.  Therefore,
seg_vn.o and svc_kudp.o were not included in the 4.1.3 patch version.

As root, backup the old files:
mv /sys/`arch -k`/OBJ/nfs_client.o /sys/`arch -k`/OBJ/nfs_client.o.FCS
mv /sys/`arch -k`/OBJ/nfs_common.o /sys/`arch -k`/OBJ/nfs_common.o.FCS
mv /sys/`arch -k`/OBJ/nfs_dump.o /sys/`arch -k`/OBJ/nfs_dump.o.FCS
mv /sys/`arch -k`/OBJ/nfs_server.o /sys/`arch -k`/OBJ/nfs_server.o.FCS
mv /sys/`arch -k`/OBJ/nfs_subr.o /sys/`arch -k`/OBJ/nfs_subr.o.FCS
mv /sys/`arch -k`/OBJ/nfs_vfsops.o /sys/`arch -k`/OBJ/nfs_vfsops.o.FCS
mv /sys/`arch -k`/OBJ/nfs_vnodeops.o /sys/`arch -k`/OBJ/nfs_vnodeops.o.FCS
mv /sys/`arch -k`/OBJ/nfs_xdr.o /sys/`arch -k`/OBJ/nfs_xdr.o.FCS
mv /sys/`arch -k`/OBJ/nfs_export.o /sys/`arch -k`/OBJ/nfs_export.o.FCS

cd /sys/nfs
mv nfs.h       nfs.h.FCS
mv nfs_clnt.h  nfs_clnt.h.FCS
mv rnode.h     rnode.h.FCS
mv export.h    export.h.FCS

cd /usr/include/nfs
mv nfs.h       nfs.h.FCS
mv nfs_clnt.h  nfs_clnt.h.FCS
mv rnode.h     rnode.h.FCS
mv export.h    export.h.FCS

Now install the patched files from the patch directory location:
cp `arch -k`/nfs_client.o /sys/`arch -k`/OBJ/nfs_client.o
cp `arch -k`/nfs_common.o /sys/`arch -k`/OBJ/nfs_common.o
cp `arch -k`/nfs_dump.o /sys/`arch -k`/OBJ/nfs_dump.o
cp `arch -k`/nfs_server.o /sys/`arch -k`/OBJ/nfs_server.o
cp `arch -k`/nfs_subr.o /sys/`arch -k`/OBJ/nfs_subr.o
cp `arch -k`/nfs_vfsops.o /sys/`arch -k`/OBJ/nfs_vfsops.o
cp `arch -k`/nfs_vnodeops.o /sys/`arch -k`/OBJ/nfs_vnodeops.o
cp `arch -k`/nfs_xdr.o /sys/`arch -k`/OBJ/nfs_xdr.o

NOTE : The following module should *NOT* be copied only for the SunDBE
system. The SunDBE version of nfs_export.o should be used.

cp `arch -k`/nfs_export.o /sys/`arch -k`/OBJ/nfs_export.o

cp nfs.h       /sys/nfs
cp nfs_clnt.h  /sys/nfs
cp rnode.h     /sys/nfs
cp export.h    /sys/nfs

cp nfs.h       /usr/include/nfs
cp nfs_clnt.h  /usr/include/nfs
cp rnode.h     /usr/include/nfs
cp export.h    /usr/include/nfs

Config, make and install a new kernel.

Please refer to the system and networking administration manual
for details on building and installing a new kernel
