lkml.org 
[lkml]   [2005]   [Sep]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patches in this message
    /
    SubjectRe: [PATCH] nfs client, kernel 2.4.31: readlink result overflow
    From
    Date
    Peter Staubach <staubach@redhat.com> writes:
    > Yes, I think that there is a bug in the boundary checking. I think that:
    >
    > if (len > rcvbuf->page_len)
    >
    > should be
    >
    > if (len >= rcvbuf->page_len - sizeof(u32) || len > 1024)

    Thanks for your feedback. The patch to 2.4.31 that incorporates your
    suggsted changes is here:

    diff -u linux-2.4.31.orig/fs/nfs/nfs2xdr.c linux-2.4.31/fs/nfs/nfs2xdr.c
    --- linux-2.4.31.orig/fs/nfs/nfs2xdr.c 2002-11-28 18:53:15.000000000 -0500
    +++ linux-2.4.31/fs/nfs/nfs2xdr.c 2005-09-14 15:33:30.000000000 -0400
    @@ -571,8 +571,8 @@
    strlen = (u32*)kmap(rcvbuf->pages[0]);
    /* Convert length of symlink */
    len = ntohl(*strlen);
    - if (len > rcvbuf->page_len)
    - len = rcvbuf->page_len;
    + if (len >= rcvbuf->page_len - sizeof(u32) || len > NFS2_MAXPATHLEN)
    + len = rcvbuf->page_len - sizeof(u32) - 1;
    *strlen = len;
    /* NULL terminate the string we got */
    string = (char *)(strlen + 1);
    diff -u linux-2.4.31.orig/fs/nfs/nfs3xdr.c linux-2.4.31/fs/nfs/nfs3xdr.c
    --- linux-2.4.31.orig/fs/nfs/nfs3xdr.c 2003-11-28 13:26:21.000000000 -0500
    +++ linux-2.4.31/fs/nfs/nfs3xdr.c 2005-09-14 15:33:53.000000000 -0400
    @@ -759,8 +759,8 @@
    strlen = (u32*)kmap(rcvbuf->pages[0]);
    /* Convert length of symlink */
    len = ntohl(*strlen);
    - if (len > rcvbuf->page_len)
    - len = rcvbuf->page_len;
    + if (len >= rcvbuf->page_len - sizeof(u32))
    + len = rcvbuf->page_len - sizeof(u32) - 1;
    *strlen = len;
    /* NULL terminate the string we got */
    string = (char *)(strlen + 1);
    > The 2.6 kernel code is also broken, but in a different, but once again,
    > similar fashions.

    You mean for length > 1024 ?
    diff -u linux-2.6.13.orig/fs/nfs/nfs2xdr.c linux-2.6.13/fs/nfs/nfs2xdr.c
    --- linux-2.6.13.orig/fs/nfs/nfs2xdr.c 2005-08-28 19:41:01.000000000 -0400
    +++ linux-2.6.13/fs/nfs/nfs2xdr.c 2005-09-14 15:40:13.000000000 -0400
    @@ -557,7 +557,7 @@
    return -nfs_stat_to_errno(status);
    /* Convert length of symlink */
    len = ntohl(*p++);
    - if (len >= rcvbuf->page_len || len <= 0) {
    + if (len >= rcvbuf->page_len || len <= 0 || len > NFS2_MAXPATHLEN) {
    dprintk(KERN_WARNING "nfs: server returned giant symlink!\n");
    return -ENAMETOOLONG;
    }
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/
    \
     
     \ /
      Last update: 2005-09-14 21:45    [W:0.027 / U:0.612 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site