Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <515795668bb6955c51eac0fcdd3154f2f01b2728.camel@kernel.org>
Subject: Re: [PATCH v2] lockd: detect and reject lock arguments that overflow
From:   Jeff Layton <jlayton@kernel.org>
To:     Chuck Lever III <chuck.lever@oracle.com>
Cc:     Bruce Fields <bfields@fieldses.org>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        Jan Kasiak <j.kasiak@gmail.com>
Date:   Tue, 02 Aug 2022 11:54:28 -0400
In-Reply-To: <07E1B05E-B611-4831-95BD-962C7C378675@oracle.com>
References: <20220801195726.154229-1-jlayton@kernel.org>
         <D34C84D6-B1BA-4200-9879-B0AD6CE8AB00@oracle.com>
         <643b9dc1976a24a65cb6160ce3e16c57afa59b84.camel@kernel.org>
         <07E1B05E-B611-4831-95BD-962C7C378675@oracle.com>
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.3 (3.44.3-1.fc36) 
MIME-Version: 1.0
Precedence: bulk

On Tue, 2022-08-02 at 15:52 +0000, Chuck Lever III wrote:
>=20
> > On Aug 2, 2022, at 11:47 AM, Jeff Layton <jlayton@kernel.org> wrote:
> >=20
> > On Tue, 2022-08-02 at 14:10 +0000, Chuck Lever III wrote:
> > >=20
> > > > On Aug 1, 2022, at 3:57 PM, Jeff Layton <jlayton@kernel.org> wrote:
> > > >=20
> > > > lockd doesn't currently vet the start and length in nlm4 requests l=
ike
> > > > it should, and can end up generating lock requests with arguments t=
hat
> > > > overflow when passed to the filesystem.
> > > >=20
> > > > The NLM4 protocol uses unsigned 64-bit arguments for both start and
> > > > length, whereas struct file_lock tracks the start and end as loff_t
> > > > values. By the time we get around to calling nlm4svc_retrieve_args,
> > > > we've lost the information that would allow us to determine if ther=
e was
> > > > an overflow.
> > > >=20
> > > > Start tracking the actual start and len for NLM4 requests in the
> > > > nlm_lock. In nlm4svc_retrieve_args, vet these values to ensure they
> > > > won't cause an overflow, and return NLM4_FBIG if they do.
> > > >=20
> > > > Link: https://bugzilla.linux-nfs.org/show_bug.cgi?id=3D392
> > > > Reported-by: Jan Kasiak <j.kasiak@gmail.com>
> > > > Signed-off-by: Jeff Layton <jlayton@kernel.org>
> > >=20
> > > I've applied this one to my private tree for testing.
> > > Thanks Jeff!
> > >=20
> > >=20
> >=20
> > Thank you. We should probably also consider sending this to stable
> > kernels too. It's at least a DoS vector.
>=20
> Agreed, though it won't apply before 345b4159a075 ("lockd: Update
> the NLMv4 TEST arguments decoder to use struct xdr_stream")
>=20
> How about:
>=20
> Cc: <stable@vger.kernel.org> # 5.14
>=20
>=20

Works for me. We could probably spin up a version for earlier kernels
too if necessary.

> > > > ---
> > > > fs/lockd/svc4proc.c       |  8 ++++++++
> > > > fs/lockd/xdr4.c           | 19 ++-----------------
> > > > include/linux/lockd/xdr.h |  2 ++
> > > > 3 files changed, 12 insertions(+), 17 deletions(-)
> > > >=20
> > > > v2: record args as u64s in nlm_lock and check them in
> > > >   nlm4svc_retrieve_args
> > > >=20
> > > > diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
> > > > index 176b468a61c7..e5adb524a445 100644
> > > > --- a/fs/lockd/svc4proc.c
> > > > +++ b/fs/lockd/svc4proc.c
> > > > @@ -32,6 +32,10 @@ nlm4svc_retrieve_args(struct svc_rqst *rqstp, st=
ruct nlm_args *argp,
> > > > 	if (!nlmsvc_ops)
> > > > 		return nlm_lck_denied_nolocks;
> > > >=20
> > > > +	if (lock->lock_start > OFFSET_MAX ||
> > > > +	    (lock->lock_len && ((lock->lock_len - 1) > (OFFSET_MAX - lock=
->lock_start))))
> > > > +		return nlm4_fbig;
> > > > +
> > > > 	/* Obtain host handle */
> > > > 	if (!(host =3D nlmsvc_lookup_host(rqstp, lock->caller, lock->len))
> > > > 	 || (argp->monitor && nsm_monitor(host) < 0))
> > > > @@ -50,6 +54,10 @@ nlm4svc_retrieve_args(struct svc_rqst *rqstp, st=
ruct nlm_args *argp,
> > > > 		/* Set up the missing parts of the file_lock structure */
> > > > 		lock->fl.fl_file  =3D file->f_file[mode];
> > > > 		lock->fl.fl_pid =3D current->tgid;
> > > > +		lock->fl.fl_start =3D (loff_t)lock->lock_start;
> > > > +		lock->fl.fl_end =3D lock->lock_len ?
> > > > +				   (loff_t)(lock->lock_start + lock->lock_len - 1) :
> > > > +				   OFFSET_MAX;
> > > > 		lock->fl.fl_lmops =3D &nlmsvc_lock_operations;
> > > > 		nlmsvc_locks_init_private(&lock->fl, host, (pid_t)lock->svid);
> > > > 		if (!lock->fl.fl_owner) {
> > > > diff --git a/fs/lockd/xdr4.c b/fs/lockd/xdr4.c
> > > > index 856267c0864b..712fdfeb8ef0 100644
> > > > --- a/fs/lockd/xdr4.c
> > > > +++ b/fs/lockd/xdr4.c
> > > > @@ -20,13 +20,6 @@
> > > >=20
> > > > #include "svcxdr.h"
> > > >=20
> > > > -static inline loff_t
> > > > -s64_to_loff_t(__s64 offset)
> > > > -{
> > > > -	return (loff_t)offset;
> > > > -}
> > > > -
> > > > -
> > > > static inline s64
> > > > loff_t_to_s64(loff_t offset)
> > > > {
> > > > @@ -70,8 +63,6 @@ static bool
> > > > svcxdr_decode_lock(struct xdr_stream *xdr, struct nlm_lock *lock)
> > > > {
> > > > 	struct file_lock *fl =3D &lock->fl;
> > > > -	u64 len, start;
> > > > -	s64 end;
> > > >=20
> > > > 	if (!svcxdr_decode_string(xdr, &lock->caller, &lock->len))
> > > > 		return false;
> > > > @@ -81,20 +72,14 @@ svcxdr_decode_lock(struct xdr_stream *xdr, stru=
ct nlm_lock *lock)
> > > > 		return false;
> > > > 	if (xdr_stream_decode_u32(xdr, &lock->svid) < 0)
> > > > 		return false;
> > > > -	if (xdr_stream_decode_u64(xdr, &start) < 0)
> > > > +	if (xdr_stream_decode_u64(xdr, &lock->lock_start) < 0)
> > > > 		return false;
> > > > -	if (xdr_stream_decode_u64(xdr, &len) < 0)
> > > > +	if (xdr_stream_decode_u64(xdr, &lock->lock_len) < 0)
> > > > 		return false;
> > > >=20
> > > > 	locks_init_lock(fl);
> > > > 	fl->fl_flags =3D FL_POSIX;
> > > > 	fl->fl_type  =3D F_RDLCK;
> > > > -	end =3D start + len - 1;
> > > > -	fl->fl_start =3D s64_to_loff_t(start);
> > > > -	if (len =3D=3D 0 || end < 0)
> > > > -		fl->fl_end =3D OFFSET_MAX;
> > > > -	else
> > > > -		fl->fl_end =3D s64_to_loff_t(end);
> > > >=20
> > > > 	return true;
> > > > }
> > > > diff --git a/include/linux/lockd/xdr.h b/include/linux/lockd/xdr.h
> > > > index 398f70093cd3..67e4a2c5500b 100644
> > > > --- a/include/linux/lockd/xdr.h
> > > > +++ b/include/linux/lockd/xdr.h
> > > > @@ -41,6 +41,8 @@ struct nlm_lock {
> > > > 	struct nfs_fh		fh;
> > > > 	struct xdr_netobj	oh;
> > > > 	u32			svid;
> > > > +	u64			lock_start;
> > > > +	u64			lock_len;
> > > > 	struct file_lock	fl;
> > > > };
> > > >=20
> > > > --=20
> > > > 2.37.1
> > > >=20
> > >=20
> > > --
> > > Chuck Lever
> > >=20
> > >=20
> > >=20
> >=20
> > --=20
> > Jeff Layton <jlayton@kernel.org>
>=20
> --
> Chuck Lever
>=20
>=20
>=20

--=20
Jeff Layton <jlayton@kernel.org>