From patchwork Wed Apr 13 18:31:31 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bryan Schumaker X-Patchwork-Id: 705531 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p3DIVXNN010210 for ; Wed, 13 Apr 2011 18:31:37 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757105Ab1DMSbg (ORCPT ); Wed, 13 Apr 2011 14:31:36 -0400 Received: from mx2.netapp.com ([216.240.18.37]:47698 "EHLO mx2.netapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757107Ab1DMSbe (ORCPT ); Wed, 13 Apr 2011 14:31:34 -0400 X-IronPort-AV: E=Sophos;i="4.64,205,1301900400"; d="scan'208";a="541136779" Received: from smtp1.corp.netapp.com ([10.57.156.124]) by mx2-out.netapp.com with ESMTP; 13 Apr 2011 11:31:34 -0700 Received: from [10.30.16.245] (kuppam-pc.hq.netapp.com [10.30.16.245] (may be forged)) by smtp1.corp.netapp.com (8.13.1/8.13.1/NTAP-1.6) with ESMTP id p3DIVV6c012489; Wed, 13 Apr 2011 11:31:32 -0700 (PDT) Message-ID: <4DA5EC03.9000301@netapp.com> Date: Wed, 13 Apr 2011 14:31:31 -0400 From: Bryan Schumaker User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110307 Lightning/1.0b2 Lanikai/3.1.9 MIME-Version: 1.0 To: "Myklebust, Trond" CC: "linux-nfs@vger.kernel.org" Subject: [PATCH 6/6] NFS: Use correct variable for page bounds checking Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Wed, 13 Apr 2011 18:31:37 +0000 (UTC) While decoding a secinfo reply, I store the list of supported sec flavors on a page accessible through res->flavors. Before reading each new flavor, I do some math to determine if there is enough space left on this page, and I break out of my read look if there isn't. In order to perform this check correctly, I need to use the address of res->flavors, rather than the address of res. When this loop was broken early I lied to the caller and told them that the entire list had been decoded. This could lead to problems if the caller tries to use any the garbage data claiming to be a valid sec flavor. I fixed this by using res->flavors->num_flavors as a counter, incrementing it every time a sec flavor is successfully decoded. Signed-off-by: Bryan Schumaker --- fs/nfs/nfs4xdr.c | 11 +++++++---- 1 files changed, 7 insertions(+), 4 deletions(-) diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index dddfb57..ba952bd 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -4838,17 +4838,19 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res) struct nfs4_secinfo_flavor *sec_flavor; int status; __be32 *p; - int i; + int i, num_flavors; status = decode_op_hdr(xdr, OP_SECINFO); p = xdr_inline_decode(xdr, 4); if (unlikely(!p)) goto out_overflow; - res->flavors->num_flavors = be32_to_cpup(p); - for (i = 0; i < res->flavors->num_flavors; i++) { + res->flavors->num_flavors = 0; + num_flavors = be32_to_cpup(p); + + for (i = 0; i < num_flavors; i++) { sec_flavor = &res->flavors->flavors[i]; - if ((char *)&sec_flavor[1] - (char *)res > PAGE_SIZE) + if ((char *)&sec_flavor[1] - (char *)res->flavors > PAGE_SIZE) break; p = xdr_inline_decode(xdr, 4); @@ -4860,6 +4862,7 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res) if (decode_secinfo_gss(xdr, sec_flavor)) break; } + res->flavors->num_flavors++; } return 0;