linux-kernel - Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 10 May 2017 05:24:54 +0000
From:   Ari Kauppi <Ari.Kauppi@...opsys.com>
To:     Colin Ian King <colin.king@...onical.com>,
        "J . Bruce Fields" <bfields@...ldses.org>,
        Dan Carpenter <dan.carpenter@...cle.com>
CC:     Ari Kauppi <Ari.Kauppi@...opsys.com>,
        Jeff Layton <jlayton@...chiereds.net>,
        "linux-nfs@...r.kernel.org" <linux-nfs@...r.kernel.org>,
        "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops


> On 10.5.2017, at 0.14, Colin Ian King <colin.king@...onical.com> wrote:
> 
> On 09/05/17 22:03, J . Bruce Fields wrote:
>> On Tue, May 09, 2017 at 05:04:14PM +0300, Dan Carpenter wrote:
>>> On Tue, May 09, 2017 at 02:31:21PM +0100, Colin King wrote:
>>>> diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
>>>> index 1dbf62190bee..c453a1998e00 100644
>>>> --- a/fs/nfsd/nfs4proc.c
>>>> +++ b/fs/nfsd/nfs4proc.c
>>>> @@ -1259,7 +1259,8 @@ nfsd4_layout_verify(struct svc_export *exp, unsigned int layout_type)
>>>> 		return NULL;
>>>> 	}
>>>> 
>>>> -	if (layout_type >= 32 || !(exp->ex_layout_types & (1 << layout_type))) {
>>>> +	if (layout_type >= LAYOUT_TYPE_MAX ||
>>>> +	    !(exp->ex_layout_types & (1 << layout_type))) {
>>> 
>>> The 32 is there to prevent a shift wrapping bug.  The bit test prevents
>>> a buffer overflow so this can't actually overflow.
>> 
>> Yes, looks like a false positive for coverity.
>> 
>>> But this change doesn't hurt and is probably cleaner.
>> 
>> Sure.  Hope it's OK if I just merge this into the previous commit:
> 
> Fine by me.  Colin

Looks good to me.

Thanks,

--
Ari