linux-kernel - [PATCH] nfsd4: do not compute undefined pointer arithmetic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 15 Apr 2013 16:16:23 +0200
From:	"Jason A. Donenfeld" <Jason@...c4.com>
To:	linux-kernel@...r.kernel.org
Cc:	"Jason A. Donenfeld" <Jason@...c4.com>, re.emese@...il.com,
	pageexec@...email.hu
Subject: [PATCH] nfsd4: do not compute undefined pointer arithmetic

From: "Jason A. Donenfeld" <Jason@...c4.com>

If statp is NULL, "NULL - ptr_value" will be computed, which is
undefined behavior:

    When two pointers are subtracted, both shall point to elements of
    the same array object, or one past the last element of the array
    object; the result is the difference of the subscripts of the two
    array elements. -6.5.6.9

This causes issues with the PaX size overflow gcc plugin, and may cause
problems in other compiler instrumentation and other issues down the
line.

The PaX error message is as follows:

    PAX: size overflow detected in function nfsd_cache_update fs/nfsd/nfscache.c:267 cicus.155_59 min, count: 26
    Pid: 10581, comm: nfsd Not tainted 3.8.6-grsec #4
    Call Trace:
     [<ffffffff8114fbd0>] ? report_size_overflow+0x20/0x30
     [<ffffffff81241e52>] ? nfsd_cache_update+0x232/0x270
     [<ffffffff81238062>] ? nfsd_dispatch+0x112/0x190
     [<ffffffff81616320>] ? svc_process_common+0x410/0x5c0
     [<ffffffff81617302>] ? svc_process+0x102/0x160
     [<ffffffff81237a4f>] ? nfsd+0xaf/0x120
     [<ffffffff812379a0>] ? nfsd_destroy+0x70/0x70
     [<ffffffff810ad03f>] ? kthread+0xaf/0xc0
     [<ffffffff810acf90>] ? __kthread_bind+0x30/0x30
     [<ffffffff8164c2f2>] ? ret_from_fork+0x72/0xa0
     [<ffffffff810acf90>] ? __kthread_bind+0x30/0x30

Signed-off-by: Jason A. Donenfeld <Jason@...c4.com>
---
 fs/nfsd/nfscache.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index ca05f6d..466d108 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -466,8 +466,11 @@ nfsd_cache_update(struct svc_rqst *rqstp, int cachetype, __be32 *statp)
 	if (!rp)
 		return;
 
-	len = resv->iov_len - ((char*)statp - (char*)resv->iov_base);
-	len >>= 2;
+	/* Do not calculate NULL - ptr_value, as it overflows. */
+	if (statp) {
+		len = resv->iov_len - ((char*)statp - (char*)resv->iov_base);
+		len >>= 2;
+	}
 
 	/* Don't cache excessive amounts of data and XDR failures */
 	if (!statp || len > (256 >> 2)) {
-- 
1.8.1.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/