linux-kernel - re: libceph: follow redirect replies from osds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6ea7e486-a3f3-7def-1f88-2e645e3b9780@canonical.com>
Date:   Fri, 28 Feb 2020 12:46:11 +0000
From:   Colin Ian King <colin.king@...onical.com>
To:     Ilya Dryomov <idryomov@...il.com>,
        Jeff Layton <jlayton@...nel.org>, Sage Weil <sage@...hat.co>,
        ceph-devel@...r.kernel.org
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: re: libceph: follow redirect replies from osds

Hi,

Static analysis with Coverity has detected a potential issue in the
following commit in function ceph_redirect_decode():

commit 205ee1187a671c3b067d7f1e974903b44036f270
Author: Ilya Dryomov <ilya.dryomov@...tank.com>
Date:   Mon Jan 27 17:40:20 2014 +0200

    libceph: follow redirect replies from osds

The issue is as follows:

3486        len = ceph_decode_32(p);

Unused value (UNUSED_VALUE)
assigned_pointer: Assigning value from len to *p here, but that stored
value is overwritten before it can be used.

3487        *p += len; /* skip osd_instructions */
3488
3489        /* skip the rest */

value_overwrite: Overwriting previous write to *p with value from
struct_end.

3490        *p = struct_end;

The *p assignment in line 3487 is effectively being overwritten by the
*p assignment in 3490.  Maybe the following is correct:

        len = ceph_decode_32(p);
-       p += len; /* skip osd_instructions */
+       struct_end = *p + len;  /* skip osd_instructions */

        /* skip the rest */
        *p = struct_end;

I'm not familiar with the ceph structure here, so I'm not sure what the
correct fix would be.

Colin