linux-kernel - Re: [PATCH] NFS: remove unneeded check in decode_devicenotify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Feb 2022 10:30:47 -0500
From:   Anna Schumaker <anna@...nel.org>
To:     Alexey Khoroshilov <khoroshilov@...ras.ru>
Cc:     Trond Myklebust <trond.myklebust@...merspace.com>,
        Linux NFS Mailing List <linux-nfs@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        ldv-project@...uxtesting.org
Subject: Re: [PATCH] NFS: remove unneeded check in decode_devicenotify_args()

Hi Alexey,

On Tue, Feb 15, 2022 at 5:17 AM Alexey Khoroshilov
<khoroshilov@...ras.ru> wrote:
>
> Overflow check in not needed anymore after we switch to kmalloc_array().

Don't we still need the overflow check since 'n' is used in the
for-loop end condition farther down in this function?

Thanks,
Anna

>
> Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>
> Fixes: a4f743a6bb20 ("NFSv4.1: Convert open-coded array allocation calls to kmalloc_array()")
> ---
>  fs/nfs/callback_xdr.c | 4 ----
>  1 file changed, 4 deletions(-)
>
> diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
> index f90de8043b0f..8dcb08e1a885 100644
> --- a/fs/nfs/callback_xdr.c
> +++ b/fs/nfs/callback_xdr.c
> @@ -271,10 +271,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
>         n = ntohl(*p++);
>         if (n == 0)
>                 goto out;
> -       if (n > ULONG_MAX / sizeof(*args->devs)) {
> -               status = htonl(NFS4ERR_BADXDR);
> -               goto out;
> -       }
>
>         args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL);
>         if (!args->devs) {
> --
> 2.7.4
>