2015-12-09 12:41:35

by Sergey Nazarov

Subject: NFSv4: Possible buffer overflow in security label decode.

Hi!
Buffer overflow possible in decode_attr_security_label, if given label buffer size is not enough to
store data received from server. This adds additional check for buffer capacity:
---
fs/nfs/nfs4xdr.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 4e44412..6a6302b 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4157,7 +4157,9 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
if (unlikely(!p))
goto out_overflow;
if (len < NFS4_MAXLABELLEN) {
- if (label) {
+ if (label && label->label) {
+ if (len > label->len)
+ return -ERANGE;
memcpy(label->label, p, len);
label->len = len;
label->pi = pi;
@@ -4165,9 +4167,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
status = NFS_ATTR_FATTR_V4_SECURITY_LABEL;
}
bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
- } else
+ } else {
printk(KERN_WARNING "%s: label too long (%u)!\n",
__func__, len);
+ return -EIO;
+ }
}
if (label && label->label)
dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
--

2015-12-26 17:30:25

by Trond Myklebust

Subject: Re: NFSv4: Possible buffer overflow in security label decode.

Hi Sergey,

On Wed, Dec 9, 2015 at 7:33 AM, Nazarov Sergey <[email protected]> wrote:
> Hi!
> Buffer overflow possible in decode_attr_security_label, if given label buffer size is not enough to
> store data received from server. This adds additional check for buffer capacity:
> ---
> fs/nfs/nfs4xdr.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
> index 4e44412..6a6302b 100644
> --- a/fs/nfs/nfs4xdr.c
> +++ b/fs/nfs/nfs4xdr.c
> @@ -4157,7 +4157,9 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
> if (unlikely(!p))
> goto out_overflow;
> if (len < NFS4_MAXLABELLEN) {
> - if (label) {
> + if (label && label->label) {
> + if (len > label->len)
> + return -ERANGE;
> memcpy(label->label, p, len);
> label->len = len;
> label->pi = pi;
> @@ -4165,9 +4167,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
> status = NFS_ATTR_FATTR_V4_SECURITY_LABEL;
> }
> bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
> - } else
> + } else {
> printk(KERN_WARNING "%s: label too long (%u)!\n",
> __func__, len);
> + return -EIO;
> + }
> }
> if (label && label->label)
> dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
> --

Looks good, but could you please add a Signed-off-by: line as per the
instructions in Documentation/SubmittingPatches?

Thanks!
Trond

--
Trond Myklebust
Linux NFS client maintainer, PrimaryData
[email protected]