Various changes lifted from the OpenBSD cvs tree:

txdr_hyper and fxdr_hyper tweaks to avoid excessive CPU order knowledge.

nfs_serv.c: don't call nfsm_adj() with negative values, windows clients
could crash servers when doing a readdir of a large directory.

nfs_socket.c: Use IP_PORTRANGE to get a priviliged port without a spin
loop trying to bind().  Don't clobber a mbuf pointer or we get panics
on a NFS3ERR_JUKEBOX error from a server when reusing a freed mbuf.

nfs_subs.c: Don't loose st_blocks on NFSv2 mounts when > 2GB.

Obtained from:  OpenBSD

5 files changed, 54 insertions, 34 deletions

diff --git a/sys/nfsclient/nfs_socket.c b/sys/nfsclient/nfs_socket.c
index 2267629..8949d7a 100644
--- a/sys/nfsclient/nfs_socket.c
+++ b/sys/nfsclient/nfs_socket.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)nfs_socket.c	8.5 (Berkeley) 3/30/95
- * $Id: nfs_socket.c,v 1.51 1999/04/24 11:29:48 dt Exp $
+ * $Id: nfs_socket.c,v 1.52 1999/05/02 23:56:25 alc Exp $
  */
 
 /*
@@ -201,7 +201,6 @@ nfs_connect(nmp, rep)
 	int s, error, rcvreserve, sndreserve;
 	struct sockaddr *saddr;
 	struct sockaddr_in *sin;
-	u_int16_t tport;
 	struct proc *p = &proc0; /* only used for socreate and sobind */
 
 	nmp->nm_so = (struct socket *)0;
@@ -217,18 +216,39 @@ nfs_connect(nmp, rep)
 	 * Some servers require that the client port be a reserved port number.
 	 */
 	if (saddr->sa_family == AF_INET && (nmp->nm_flag & NFSMNT_RESVPORT)) {
+		struct sockopt sopt;
+		int ip;
 		struct sockaddr_in ssin;
+
+		bzero(&sopt, sizeof sopt);
+		ip = IP_PORTRANGE_LOW;
+		sopt.sopt_dir = SOPT_SET;
+		sopt.sopt_level = IPPROTO_IP;
+		sopt.sopt_name = IP_PORTRANGE;
+		sopt.sopt_val = (void *)&ip;
+		sopt.sopt_valsize = sizeof(ip);
+		sopt.sopt_p = NULL;
+		error = sosetopt(so, &sopt);
+		if (error)
+			goto bad;
 		bzero(&ssin, sizeof ssin);
 		sin = &ssin;
 		sin->sin_len = sizeof (struct sockaddr_in);
 		sin->sin_family = AF_INET;
 		sin->sin_addr.s_addr = INADDR_ANY;
-		tport = IPPORT_RESERVED - 1;
-		sin->sin_port = htons(tport);
-		while ((error = sobind(so, (struct sockaddr *)sin, p))
-		       == EADDRINUSE &&
-		       --tport > IPPORT_RESERVED / 2)
-			sin->sin_port = htons(tport);
+		sin->sin_port = htons(0);
+		error = sobind(so, (struct sockaddr *)sin, p);
+		if (error)
+			goto bad;
+		bzero(&sopt, sizeof sopt);
+		ip = IP_PORTRANGE_DEFAULT;
+		sopt.sopt_dir = SOPT_SET;
+		sopt.sopt_level = IPPROTO_IP;
+		sopt.sopt_name = IP_PORTRANGE;
+		sopt.sopt_val = (void *)&ip;
+		sopt.sopt_valsize = sizeof(ip);
+		sopt.sopt_p = NULL;
+		error = sosetopt(so, &sopt);
 		if (error)
 			goto bad;
 	}
@@ -908,7 +928,7 @@ nfs_request(vp, mrest, procnum, procp, cred, mrp, mdp, dposp)
 	struct mbuf **mdp;
 	caddr_t *dposp;
 {
-	register struct mbuf *m, *mrep;
+	register struct mbuf *m, *mrep, *m2;
 	register struct nfsreq *rep;
 	register u_int32_t *tl;
 	register int i;
@@ -1021,8 +1041,8 @@ tryagain:
 		if (nmp->nm_soflags & PR_CONNREQUIRED)
 			error = nfs_sndlock(rep);
 		if (!error) {
-			m = m_copym(m, 0, M_COPYALL, M_WAIT);
-			error = nfs_send(nmp->nm_so, nmp->nm_nam, m, rep);
+			m2 = m_copym(m, 0, M_COPYALL, M_WAIT);
+			error = nfs_send(nmp->nm_so, nmp->nm_nam, m2, rep);
 			if (nmp->nm_soflags & PR_CONNREQUIRED)
 				nfs_sndunlock(rep);
 		}
@@ -1157,7 +1177,7 @@ tryagain:
 				cachable = fxdr_unsigned(int, *tl++);
 				reqtime += fxdr_unsigned(int, *tl++);
 				if (reqtime > time_second) {
-				    fxdr_hyper(tl, &frev);
+				    frev = fxdr_hyper(tl);
 				    nqnfs_clientlease(nmp, np, nqlflag,
 					cachable, reqtime, frev);
 				}
@@ -1317,7 +1337,7 @@ nfs_rephead(siz, nd, slp, err, cache, frev, mrq, mbp, bposp)
 			*tl++ = txdr_unsigned(nd->nd_flag & ND_LEASE);
 			*tl++ = txdr_unsigned(cache);
 			*tl++ = txdr_unsigned(nd->nd_duration);
-			txdr_hyper(frev, tl);
+			txdr_hyper(*frev, tl);
 		} else {
 			nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
 			*tl = 0;
diff --git a/sys/nfsclient/nfs_subs.c b/sys/nfsclient/nfs_subs.c
index 9a36211..fc0b1c8 100644
--- a/sys/nfsclient/nfs_subs.c
+++ b/sys/nfsclient/nfs_subs.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)nfs_subs.c  8.8 (Berkeley) 5/22/95
- * $Id: nfs_subs.c,v 1.73 1999/02/17 13:59:29 bde Exp $
+ * $Id: nfs_subs.c,v 1.74 1999/05/11 19:54:46 phk Exp $
  */
 
 /*
@@ -1345,9 +1345,9 @@ nfs_loadattrcache(vpp, mdp, dposp, vaper)
 		vap->va_nlink = fxdr_unsigned(u_short, fp->fa_nlink);
 		vap->va_uid = fxdr_unsigned(uid_t, fp->fa_uid);
 		vap->va_gid = fxdr_unsigned(gid_t, fp->fa_gid);
-		fxdr_hyper(&fp->fa3_size, &vap->va_size);
+		vap->va_size = fxdr_hyper(&fp->fa3_size);
 		vap->va_blocksize = NFS_FABLKSIZE;
-		fxdr_hyper(&fp->fa3_used, &vap->va_bytes);
+		vap->va_bytes = fxdr_hyper(&fp->fa3_used);
 		vap->va_fileid = fxdr_unsigned(int32_t,
 		    fp->fa3_fileid.nfsuquad[1]);
 		fxdr_nfsv3time(&fp->fa3_atime, &vap->va_atime);
@@ -1360,7 +1360,7 @@ nfs_loadattrcache(vpp, mdp, dposp, vaper)
 		vap->va_gid = fxdr_unsigned(gid_t, fp->fa_gid);
 		vap->va_size = fxdr_unsigned(u_int32_t, fp->fa2_size);
 		vap->va_blocksize = fxdr_unsigned(int32_t, fp->fa2_blocksize);
-		vap->va_bytes = fxdr_unsigned(int32_t, fp->fa2_blocks)
+		vap->va_bytes = (u_quad_t)fxdr_unsigned(int32_t, fp->fa2_blocks)
 		    * NFS_FABLKSIZE;
 		vap->va_fileid = fxdr_unsigned(int32_t, fp->fa2_fileid);
 		fxdr_nfsv2time(&fp->fa2_atime, &vap->va_atime);
@@ -1810,7 +1810,7 @@ nfsm_srvwcc(nfsd, before_ret, before_vap, after_ret, after_vap, mbp, bposp)
 	} else {
 		nfsm_build(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
 		*tl++ = nfs_true;
-		txdr_hyper(&(before_vap->va_size), tl);
+		txdr_hyper(before_vap->va_size, tl);
 		tl += 2;
 		txdr_nfsv3time(&(before_vap->va_mtime), tl);
 		tl += 2;
@@ -1860,8 +1860,8 @@ nfsm_srvfattr(nfsd, vap, fp)
 	if (nfsd->nd_flag & ND_NFSV3) {
 		fp->fa_type = vtonfsv3_type(vap->va_type);
 		fp->fa_mode = vtonfsv3_mode(vap->va_mode);
-		txdr_hyper(&vap->va_size, &fp->fa3_size);
-		txdr_hyper(&vap->va_bytes, &fp->fa3_used);
+		txdr_hyper(vap->va_size, &fp->fa3_size);
+		txdr_hyper(vap->va_bytes, &fp->fa3_used);
 		fp->fa3_rdev.specdata1 = txdr_unsigned(umajor(vap->va_rdev));
 		fp->fa3_rdev.specdata2 = txdr_unsigned(uminor(vap->va_rdev));
 		fp->fa3_fsid.nfsuquad[0] = 0;
diff --git a/sys/nfsclient/nfs_vfsops.c b/sys/nfsclient/nfs_vfsops.c
index 7c2b6ec..89fe668 100644
--- a/sys/nfsclient/nfs_vfsops.c
+++ b/sys/nfsclient/nfs_vfsops.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)nfs_vfsops.c	8.12 (Berkeley) 5/20/95
- * $Id: nfs_vfsops.c,v 1.82 1999/02/16 10:49:54 dfr Exp $
+ * $Id: nfs_vfsops.c,v 1.83 1999/04/10 18:53:29 peter Exp $
  */
 
 #include <sys/param.h>
@@ -291,11 +291,11 @@ nfs_statfs(mp, sbp, p)
 	sbp->f_iosize = nfs_iosize(nmp);
 	if (v3) {
 		sbp->f_bsize = NFS_FABLKSIZE;
-		fxdr_hyper(&sfp->sf_tbytes, &tquad);
+		tquad = fxdr_hyper(&sfp->sf_tbytes);
 		sbp->f_blocks = (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
-		fxdr_hyper(&sfp->sf_fbytes, &tquad);
+		tquad = fxdr_hyper(&sfp->sf_fbytes);
 		sbp->f_bfree = (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
-		fxdr_hyper(&sfp->sf_abytes, &tquad);
+		tquad = fxdr_hyper(&sfp->sf_abytes);
 		sbp->f_bavail = (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
 		sbp->f_files = (fxdr_unsigned(int32_t,
 		    sfp->sf_tfiles.nfsuquad[1]) & 0x7fffffff);
@@ -375,7 +375,7 @@ nfs_fsinfo(nmp, vp, cred, p)
 			if (nmp->nm_readdirsize == 0)
 				nmp->nm_readdirsize = max;
 		}
-		fxdr_hyper(&fsp->fs_maxfilesize, &maxfsize);
+		maxfsize = fxdr_hyper(&fsp->fs_maxfilesize);
 		if (maxfsize > 0 && maxfsize < nmp->nm_maxfilesize)
 			nmp->nm_maxfilesize = maxfsize;
 		nmp->nm_state |= NFSSTA_GOTFSINFO;
diff --git a/sys/nfsclient/nfs_vnops.c b/sys/nfsclient/nfs_vnops.c
index 1737554..1450102 100644
--- a/sys/nfsclient/nfs_vnops.c
+++ b/sys/nfsclient/nfs_vnops.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)nfs_vnops.c	8.16 (Berkeley) 5/27/95
- * $Id: nfs_vnops.c,v 1.128 1999/05/06 20:00:30 phk Exp $
+ * $Id: nfs_vnops.c,v 1.129 1999/05/11 19:54:47 phk Exp $
  */
 
 
@@ -1048,7 +1048,7 @@ nfs_readrpc(vp, uiop, cred)
 		nfsm_fhtom(vp, v3);
 		nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED * 3);
 		if (v3) {
-			txdr_hyper(&uiop->uio_offset, tl);
+			txdr_hyper(uiop->uio_offset, tl);
 			*(tl + 2) = txdr_unsigned(len);
 		} else {
 			*tl++ = txdr_unsigned(uiop->uio_offset);
@@ -1115,7 +1115,7 @@ nfs_writerpc(vp, uiop, cred, iomode, must_commit)
 		nfsm_fhtom(vp, v3);
 		if (v3) {
 			nfsm_build(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
-			txdr_hyper(&uiop->uio_offset, tl);
+			txdr_hyper(uiop->uio_offset, tl);
 			tl += 2;
 			*tl++ = txdr_unsigned(len);
 			*tl++ = txdr_unsigned(*iomode);
@@ -2075,7 +2075,7 @@ nfs_readdirrpc(vp, uiop, cred)
 			if (v3) {
 				nfsm_dissect(tl, u_int32_t *,
 				    3 * NFSX_UNSIGNED);
-				fxdr_hyper(tl, &fileno);
+				fileno = fxdr_hyper(tl);
 				len = fxdr_unsigned(int, *(tl + 2));
 			} else {
 				nfsm_dissect(tl, u_int32_t *,
@@ -2258,7 +2258,7 @@ nfs_readdirplusrpc(vp, uiop, cred)
 		/* loop thru the dir entries, doctoring them to 4bsd form */
 		while (more_dirs && bigenough) {
 			nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
-			fxdr_hyper(tl, &fileno);
+			fileno = fxdr_hyper(tl);
 			len = fxdr_unsigned(int, *(tl + 2));
 			if (len <= 0 || len > NFS_MAXNAMLEN) {
 				error = EBADRPC;
@@ -2580,7 +2580,7 @@ nfs_commit(vp, offset, cnt, cred, procp)
 	nfsm_reqhead(vp, NFSPROC_COMMIT, NFSX_FH(1));
 	nfsm_fhtom(vp, 1);
 	nfsm_build(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
-	txdr_hyper(&offset, tl);
+	txdr_hyper(offset, tl);
 	tl += 2;
 	*tl = txdr_unsigned(cnt);
 	nfsm_request(vp, NFSPROC_COMMIT, procp, cred);
diff --git a/sys/nfsclient/nfsm_subs.h b/sys/nfsclient/nfsm_subs.h
index 3692b7b..71d9f7b 100644
--- a/sys/nfsclient/nfsm_subs.h
+++ b/sys/nfsclient/nfsm_subs.h
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)nfsm_subs.h	8.2 (Berkeley) 3/30/95
- * $Id: nfsm_subs.h,v 1.21 1998/05/31 20:08:57 peter Exp $
+ * $Id: nfsm_subs.h,v 1.22 1998/12/25 10:34:27 dfr Exp $
  */
 
 
@@ -264,7 +264,7 @@ struct mbuf *nfsm_rpchead __P((struct ucred *cr, int nmflag, int procid,
 		if ((full) && (a)->va_size != VNOVAL) {				\
 			nfsm_build(tl, u_int32_t *, 3 * NFSX_UNSIGNED);		\
 			*tl++ = nfs_true;					\
-			txdr_hyper(&(a)->va_size, tl);				\
+			txdr_hyper((a)->va_size, tl);				\
 		} else {							\
 			nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);		\
 			*tl = nfs_false;					\
@@ -479,7 +479,7 @@ struct mbuf *nfsm_rpchead __P((struct ucred *cr, int nmflag, int procid,
 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED); \
 		if (*tl == nfs_true) { \
 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED); \
-			fxdr_hyper(tl, &(a)->va_size); \
+			(a)->va_size = fxdr_hyper(tl); \
 		} \
 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED); \
 		switch (fxdr_unsigned(int, *tl)) { \