lkml.org 
[lkml]   [2005]   [Sep]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patches in this message
/
SubjectRe: [PATCH] nfs client, kernel 2.4.31: readlink result overflow
From
Date
Peter Staubach <staubach@redhat.com> writes:
> Yes, I think that there is a bug in the boundary checking. I think that:
>
> if (len > rcvbuf->page_len)
>
> should be
>
> if (len >= rcvbuf->page_len - sizeof(u32) || len > 1024)

Thanks for your feedback. The patch to 2.4.31 that incorporates your
suggsted changes is here:

diff -u linux-2.4.31.orig/fs/nfs/nfs2xdr.c linux-2.4.31/fs/nfs/nfs2xdr.c
--- linux-2.4.31.orig/fs/nfs/nfs2xdr.c 2002-11-28 18:53:15.000000000 -0500
+++ linux-2.4.31/fs/nfs/nfs2xdr.c 2005-09-14 15:33:30.000000000 -0400
@@ -571,8 +571,8 @@
strlen = (u32*)kmap(rcvbuf->pages[0]);
/* Convert length of symlink */
len = ntohl(*strlen);
- if (len > rcvbuf->page_len)
- len = rcvbuf->page_len;
+ if (len >= rcvbuf->page_len - sizeof(u32) || len > NFS2_MAXPATHLEN)
+ len = rcvbuf->page_len - sizeof(u32) - 1;
*strlen = len;
/* NULL terminate the string we got */
string = (char *)(strlen + 1);
diff -u linux-2.4.31.orig/fs/nfs/nfs3xdr.c linux-2.4.31/fs/nfs/nfs3xdr.c
--- linux-2.4.31.orig/fs/nfs/nfs3xdr.c 2003-11-28 13:26:21.000000000 -0500
+++ linux-2.4.31/fs/nfs/nfs3xdr.c 2005-09-14 15:33:53.000000000 -0400
@@ -759,8 +759,8 @@
strlen = (u32*)kmap(rcvbuf->pages[0]);
/* Convert length of symlink */
len = ntohl(*strlen);
- if (len > rcvbuf->page_len)
- len = rcvbuf->page_len;
+ if (len >= rcvbuf->page_len - sizeof(u32))
+ len = rcvbuf->page_len - sizeof(u32) - 1;
*strlen = len;
/* NULL terminate the string we got */
string = (char *)(strlen + 1);
> The 2.6 kernel code is also broken, but in a different, but once again,
> similar fashions.

You mean for length > 1024 ?
diff -u linux-2.6.13.orig/fs/nfs/nfs2xdr.c linux-2.6.13/fs/nfs/nfs2xdr.c
--- linux-2.6.13.orig/fs/nfs/nfs2xdr.c 2005-08-28 19:41:01.000000000 -0400
+++ linux-2.6.13/fs/nfs/nfs2xdr.c 2005-09-14 15:40:13.000000000 -0400
@@ -557,7 +557,7 @@
return -nfs_stat_to_errno(status);
/* Convert length of symlink */
len = ntohl(*p++);
- if (len >= rcvbuf->page_len || len <= 0) {
+ if (len >= rcvbuf->page_len || len <= 0 || len > NFS2_MAXPATHLEN) {
dprintk(KERN_WARNING "nfs: server returned giant symlink!\n");
return -ENAMETOOLONG;
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-09-14 21:45    [from the cache]
©2003-2011 Jasper Spaans. Advertise on this site