From patchwork Wed Mar 27 04:21:32 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: fanchaoting X-Patchwork-Id: 2347381 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 06785DFE82 for ; Wed, 27 Mar 2013 04:21:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751360Ab3C0EVP (ORCPT ); Wed, 27 Mar 2013 00:21:15 -0400 Received: from cn.fujitsu.com ([222.73.24.84]:8979 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1751390Ab3C0EVP (ORCPT ); Wed, 27 Mar 2013 00:21:15 -0400 X-IronPort-AV: E=Sophos;i="4.87,356,1363104000"; d="scan'208";a="6952704" Received: from unknown (HELO tang.cn.fujitsu.com) ([10.167.250.3]) by song.cn.fujitsu.com with ESMTP; 27 Mar 2013 12:18:40 +0800 Received: from fnstmail02.fnst.cn.fujitsu.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id r2R4L55f017912; Wed, 27 Mar 2013 12:21:07 +0800 Received: from [127.0.0.1] ([10.167.233.142]) by fnstmail02.fnst.cn.fujitsu.com (Lotus Domino Release 8.5.3) with ESMTP id 2013032712201517-91043 ; Wed, 27 Mar 2013 12:20:15 +0800 Message-ID: <515273CC.6030209@cn.fujitsu.com> Date: Wed, 27 Mar 2013 12:21:32 +0800 From: fanchaoting User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: "Myklebust, Trond" , "bfields@fieldses.org" CC: "linux-nfs@vger.kernel.org" Subject: [PATCH v1] nfs: nfs client decode fslocations oops if server cheating it References: <51502DB7.1010508@cn.fujitsu.com> In-Reply-To: <51502DB7.1010508@cn.fujitsu.com> X-MIMETrack: Itemize by SMTP Server on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/03/27 12:20:15, Serialize by Router on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/03/27 12:20:24, Serialize complete at 2013/03/27 12:20:24 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org now nfs server will return wrong nlocations,nservers, ncomponents to the client.for example if the nlocations is NFS4_FS_LOCATIONS_MAXENTRIES, the nfs client will decode oops when run "struct nfs4_fs_location *loc = &res->locations[res->nlocations]" ################################################################# 3599 if (res->nlocations < NFS4_FS_LOCATIONS_MAXENTRIES) 3600 res->nlocations++; ################################################################# i see if res->nlocations is NFS4_FS_LOCATIONS_MAXENTRIES -1, then next it will run res->nlocations++ and res->nlocations will be NFS4_FS_LOCATIONS_MAXENTRIES. if res->nlocations is NFS4_FS_LOCATIONS_MAXENTRIES , it maybe oops when run following code. ################################################################# ...snip... 3562 u32 m; 3563 ? struct nfs4_fs_location *loc = &res->locations[res->nlocations]; ?<--bug ,max location is NFS4_FS_LOCATIONS_MAXENTRIES-1,but now res->nlocations is NFS4_FS_LOCATIONS_MAXENTRIES 35 3565 p = xdr_inline_decode(xdr, 4); 3566 if (unlikely(!p)) 3567 goto out_overflow; 3568 m = be32_to_cpup(p); 3569 3570 ? loc->nservers = 0;<--it maybe cause oops. ...snip... ################################################# Signed-off-by: fanchaoting Reviewed-by: chendt.fnst --- fs/nfs/nfs4xdr.c | 13 ++++++++++++- 1 files changed, 12 insertions(+), 1 deletions(-) -- 1.7.1 -- -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index e3edda5..25f1769 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -3496,6 +3496,10 @@ static int decode_pathname(struct xdr_stream *xdr, struct nfs4_pathname *path) n = be32_to_cpup(p); if (n == 0) goto root_path; + if (n > NFS4_PATHNAME_MAXCOMPONENTS) { + dprintk("%s: server cheating client ncomponents :%d\n", __func__, n); + goto out_eio; + } dprintk("pathname4: "); path->ncomponents = 0; while (path->ncomponents < n) { @@ -3557,6 +3561,10 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st n = be32_to_cpup(p); if (n <= 0) goto out_eio; + if (n > NFS4_FS_LOCATIONS_MAXENTRIES) { + dprintk("%s: server cheating client nlocations :%d\n", __func__, n); + goto out_eio; + } res->nlocations = 0; while (res->nlocations < n) { u32 m; @@ -3566,7 +3574,10 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st if (unlikely(!p)) goto out_overflow; m = be32_to_cpup(p); - + if (m > NFS4_FS_LOCATION_MAXSERVERS) { + dprintk("%s: server cheating client nservers :%d\n", __func__, m); + goto out_eio; + } loc->nservers = 0; dprintk("%s: servers:\n", __func__); while (loc->nservers < m) {