From patchwork Tue Oct 24 19:07:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "J. Bruce Fields" X-Patchwork-Id: 10025407 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D013E60375 for ; Tue, 24 Oct 2017 19:07:48 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CBEC32891E for ; Tue, 24 Oct 2017 19:07:48 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BF99C289F8; Tue, 24 Oct 2017 19:07:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3876D2891E for ; Tue, 24 Oct 2017 19:07:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751705AbdJXTH3 (ORCPT ); Tue, 24 Oct 2017 15:07:29 -0400 Received: from fieldses.org ([173.255.197.46]:50382 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751280AbdJXTHY (ORCPT ); Tue, 24 Oct 2017 15:07:24 -0400 Received: by fieldses.org (Postfix, from userid 2815) id A9B5C77E; Tue, 24 Oct 2017 15:07:23 -0400 (EDT) Date: Tue, 24 Oct 2017 15:07:23 -0400 From: "J. Bruce Fields" To: Jeff Layton Cc: Weston Andros Adamson , "Gustavo A. R. Silva" , Trond Myklebust , Anna Schumaker , "David S. Miller" , linux-nfs list , netdev@vger.kernel.org, "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] net: sunrpc: svcauth_gss: use BUG_ON instead of if condition followed by BUG Message-ID: <20171024190723.GD27853@fieldses.org> References: <20171023181635.GA25334@embeddedor.com> <20171023203135.GA21106@fieldses.org> <496D700A-E9D1-4745-B5DE-24BB9231A449@monkey.org> <20171024175342.GA27853@fieldses.org> <1508869132.4780.14.camel@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1508869132.4780.14.camel@redhat.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Tue, Oct 24, 2017 at 02:18:52PM -0400, Jeff Layton wrote: > On Tue, 2017-10-24 at 13:53 -0400, J. Bruce Fields wrote: > > On Tue, Oct 24, 2017 at 01:26:49PM -0400, Weston Andros Adamson wrote: > > > Is there a reason to BUG() in these places? Couldn't we WARN_ON_ONCE and return an error? > > > > I think the BUG() will just kill an nfsd thread that isn't holding any > > interesting locks. > > > > Not necessarily. If panic_on_oops is set (and it usually is in > "production" setups), it'll crash the box there. Maybe they're getting what they asked for? > > The failures look unlikely. (Except for that read_u32... return, I > > wonder if we're missing a check there.) > > Agreed, looks like you only hit an error if the read attempts to go out > of bounds. In principle that shouldn't ever happen (and I haven't seen > any reports of it). > > Still...I agree with Dros that it's better to handle this without > oopsing if we can. We can return an error from either of those > functions. A sane error and a WARN_ONCE would be better here. OK, OK, OK. There are also some more BUGs that could use looking into if anyone wants to. --b. commit eb754930662f Author: J. Bruce Fields Date: Tue Oct 24 14:58:11 2017 -0400 rpc: remove some BUG()s It would be kinder to WARN() and recover in several spots here instead of BUG()ing. Also, it looks like the read_u32_from_xdr_buf() call could actually fail, though it might require a broken (or malicious) client, so convert that to just an error return. Reported-by: Weston Andros Adamson Signed-off-by: J. Bruce Fields --- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index 7b1ee5a0b03c..73165e9ca5bf 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -855,11 +855,13 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g return stat; if (integ_len > buf->len) return stat; - if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) - BUG(); + if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) { + WARN_ON_ONCE(1); + return stat; + } /* copy out mic... */ if (read_u32_from_xdr_buf(buf, integ_len, &mic.len)) - BUG(); + return stat; if (mic.len > RPC_MAX_AUTH_SIZE) return stat; mic.data = kmalloc(mic.len, GFP_KERNEL); @@ -1611,8 +1613,10 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp) BUG_ON(integ_len % 4); *p++ = htonl(integ_len); *p++ = htonl(gc->gc_seq); - if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, integ_len)) - BUG(); + if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, integ_len)) { + WARN_ON_ONCE(1); + goto out_err; + } if (resbuf->tail[0].iov_base == NULL) { if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE) goto out_err;