Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Trond Myklebust <trondmy@hammerspace.com>
CC:     Anna Schumaker <anna@kernel.org>,
        Dan Carpenter <dan.carpenter@oracle.com>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        "kernel-janitors@vger.kernel.org" <kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH v2] NFSD: prevent integer overflow on 32 bit systems
Thread-Topic: [PATCH v2] NFSD: prevent integer overflow on 32 bit systems
Thread-Index: AQHYOIIiG1b4nLELAUOop5poNWiQ3KzAoJWA
Date:   Tue, 15 Mar 2022 16:22:03 +0000
Message-ID: <C81665CA-D2FB-45EC-BE01-7384B567356B@oracle.com>
References: <20220315153406.GA1527@kili>
In-Reply-To: <20220315153406.GA1527@kili>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?zok3DDAFn9ytzZ8i/U/zAgyE33SVCr+OTEj/yBmMSeOYqQ/Q1qXyZW7X5Q1z?=
 =?us-ascii?Q?h2wc6oKDKCRpZ5XqBGp7niyAOEIhJL7wiYIeeA4IrfgHuBiBtWxy9BH8Myen?=
 =?us-ascii?Q?rhoU7jBLbcEuYcOMhPRxkj0to5JcfMxTeSqQKnAXEoQf7d/HNyoyTw0tFzgy?=
 =?us-ascii?Q?XTrkWZkxkxlJXsuEZxIeume3hsG/XtlNpp82mvZ/ss3WPF9rjoraYVIVy5vx?=
 =?us-ascii?Q?43qUtAOBsX1eYaNDjDc8P59QnZS5GKztUJOtL3HgRuKTwA/qrDpCIAhKZLdD?=
 =?us-ascii?Q?Gr2lzcojl3b8w/wh2dVC41cbbNKJBgafz2FbWpBQGYvgx42BFNBwqGA5/Vyj?=
 =?us-ascii?Q?byItAs3rQ9lRf8pKDP5Q4u34AS04I+oamJ42fNzLeV6a31pFIGPHAeLg7Jny?=
 =?us-ascii?Q?guw7bYZJE+rCPQnInKlV3x2xpm8dRO+dd0BZNknk9TxfDeD4sDjnt5rAfVZJ?=
 =?us-ascii?Q?ljipY8OTZPWs82XCkLS0A5jabr7+7t29c7JuEZ/OQ1N39nxUnIKDY8CbdRgc?=
 =?us-ascii?Q?UFXy05uOAcadTUGnjLBEJYBdSrHTak8snAoN1qvvJGJT0lpt9CfVrjy+qpyb?=
 =?us-ascii?Q?3qjtakK0Es1wRT13nhxNyUER6VFHji/gaAB8hU1LnmbpSDFIUZWwQh+0cwb2?=
 =?us-ascii?Q?JQPNa/m6s06MIsRfkAWhRSv02I9LhGY97gmV4ag2eQiDDX4q/3SSmez8uEzI?=
 =?us-ascii?Q?MJDzvmvl8tVOjEC9q2tqxj2GFobtKt3QKgJWFtAPb2A38gFEdnwqfpbOM2vb?=
 =?us-ascii?Q?Wc9TwM5w9OyQ8aIOtdRSRdtYwOor2ho+UG+uQXEACJzX8aqyYean85qkPxOI?=
 =?us-ascii?Q?vpnC6n8bzKgUqfcoQl0e0ZnaOD3+tGJtQAWuZTQpf5EftfyXtbqee4rIQ1/i?=
 =?us-ascii?Q?dljR8EE5tLhkx+mAXcg7WiGezEkAuiBgNEjjgUmluCdC5L32l3YMqjdfVdlk?=
 =?us-ascii?Q?Ce69VX7ON9aYr4W5LApRB+L8fBRoaqt3yhHhcrhG0jWQaEwRqLn3R07AkMin?=
 =?us-ascii?Q?B1BsPQWosqxUweIARL3S4WP8d/lzDYeXbn9LcHWEwjiuqll9IFmQR0Qcq1MG?=
 =?us-ascii?Q?LR0Z/qvPwWdZq9lbc02DP5RejFz7L++z4d0XXgeeLSYwpfDW4IiHFySqpVEI?=
 =?us-ascii?Q?pvOLUJ2Yg3D/iq0D4F45RqROTYOYXP27enREUg9o0O6eATfIUV2S51+XtDrS?=
 =?us-ascii?Q?bkuC9FL2CLuTxVX96rOTXB1XKWpr8Ws+ZqcBC7Lzz/XIz4q8NMvqY9m+moTb?=
 =?us-ascii?Q?Aspq12CF5bp+Ia0RjvyJp6SGFdt5sZOLz7CONKoXRFiQnkZLBJTR17GclKY3?=
 =?us-ascii?Q?4JWgVhcHvq4UqQl1XkBUw8uhs8TOjVyvjbuKOQ5GYsBEytGmaJlWECD3/DlL?=
 =?us-ascii?Q?u0mDLbjU8DVy1DqiwHVBdKuVy5afT9/YA5omcbm8TLoeHnj+a51o85lk2fb4?=
 =?us-ascii?Q?Vk9i/LWIArJJWbIyABT5b65zNdzJQzmn3R1XvMU81LSNVLIbb6zrAQ=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4A74260340AB6F4A869A1B376FC8CAC4@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d8167c4b-faf2-4df4-4676-08da069ff08b
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2022 16:22:03.0009
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: gR1cXM8dit3cXPSQL9cH1OH2c3zbk7qe9DO30gI7NzlmpiVksQ/5I3PtvwSJ1Ew1AnbyIFYyKWEwtAFbXhKVZQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1536
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10287 signatures=693139
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0 phishscore=0
 suspectscore=0 mlxscore=0 adultscore=0 spamscore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2203150102
X-Proofpoint-GUID: H6gzMVwxEpw8vO9qh65ezSqc6FF2PhM2
X-Proofpoint-ORIG-GUID: H6gzMVwxEpw8vO9qh65ezSqc6FF2PhM2
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Mar 15, 2022, at 11:34 AM, Dan Carpenter <dan.carpenter@oracle.com> wr=
ote:
>=20
> On a 32 bit system, the "len * sizeof(*p)" operation can have an
> integer overflow.
>=20
> c: stable@vger.kernel.org
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Trond, this patch was To: me, but either you or I can take this.
Please let me know your preference.


> ---
> v2: add stable to the CC.  Use SIZE_MAX.
>=20
> include/linux/sunrpc/xdr.h | 2 ++
> 1 file changed, 2 insertions(+)
>=20
> diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
> index b519609af1d0..4417f667c757 100644
> --- a/include/linux/sunrpc/xdr.h
> +++ b/include/linux/sunrpc/xdr.h
> @@ -731,6 +731,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr=
,
>=20
> 	if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0))
> 		return -EBADMSG;
> +	if (len > SIZE_MAX / sizeof(*p))
> +		return -EBADMSG;
> 	p =3D xdr_inline_decode(xdr, len * sizeof(*p));
> 	if (unlikely(!p))
> 		return -EBADMSG;
> --=20
> 2.20.1
>=20

--
Chuck Lever