2022-03-15 19:03:53

by Chuck Lever III

[permalink] [raw]
Subject: Re: [PATCH v2] NFSD: prevent integer overflow on 32 bit systems



> On Mar 15, 2022, at 11:34 AM, Dan Carpenter <[email protected]> wrote:
>
> On a 32 bit system, the "len * sizeof(*p)" operation can have an
> integer overflow.
>
> c: [email protected]
> Signed-off-by: Dan Carpenter <[email protected]>

Trond, this patch was To: me, but either you or I can take this.
Please let me know your preference.


> ---
> v2: add stable to the CC. Use SIZE_MAX.
>
> include/linux/sunrpc/xdr.h | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
> index b519609af1d0..4417f667c757 100644
> --- a/include/linux/sunrpc/xdr.h
> +++ b/include/linux/sunrpc/xdr.h
> @@ -731,6 +731,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr,
>
> if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0))
> return -EBADMSG;
> + if (len > SIZE_MAX / sizeof(*p))
> + return -EBADMSG;
> p = xdr_inline_decode(xdr, len * sizeof(*p));
> if (unlikely(!p))
> return -EBADMSG;
> --
> 2.20.1
>

--
Chuck Lever




2022-03-16 10:43:41

by Trond Myklebust

[permalink] [raw]
Subject: Re: [PATCH v2] NFSD: prevent integer overflow on 32 bit systems

On Tue, 2022-03-15 at 16:22 +0000, Chuck Lever III wrote:
>
>
> > On Mar 15, 2022, at 11:34 AM, Dan Carpenter
> > <[email protected]> wrote:
> >
> > On a 32 bit system, the "len * sizeof(*p)" operation can have an
> > integer overflow.
> >
> > c: [email protected]
> > Signed-off-by: Dan Carpenter <[email protected]>
>
> Trond, this patch was To: me, but either you or I can take this.
> Please let me know your preference.
>

I don't mind either way. If you've got it applied already, then let's
send it through your tree.



--
Trond Myklebust
Linux NFS client maintainer, Hammerspace
[email protected]


2022-03-16 11:51:08

by Chuck Lever III

[permalink] [raw]
Subject: Re: [PATCH v2] NFSD: prevent integer overflow on 32 bit systems



> On Mar 15, 2022, at 12:30 PM, Trond Myklebust <[email protected]> wrote:
>
> On Tue, 2022-03-15 at 16:22 +0000, Chuck Lever III wrote:
>>
>>
>>> On Mar 15, 2022, at 11:34 AM, Dan Carpenter
>>> <[email protected]> wrote:
>>>
>>> On a 32 bit system, the "len * sizeof(*p)" operation can have an
>>> integer overflow.
>>>
>>> c: [email protected]
>>> Signed-off-by: Dan Carpenter <[email protected]>
>>
>> Trond, this patch was To: me, but either you or I can take this.
>> Please let me know your preference.
>>
>
> I don't mind either way. If you've got it applied already, then let's
> send it through your tree.

I've applied this one and "prevent underflow in nfssvc_decode_writeargs".
Thanks, Trond and Dan!


--
Chuck Lever