From: Jan Harkes <jaharkes@cs.cmu.edu>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Jan Harkes <jaharkes@cs.cmu.edu>,
linux-fsdevel@vger.kernel.org,
Dan Carpenter <dan.carpenter@oracle.com>
Subject: [PATCH 04/22] coda: potential buffer overflow in coda_psdev_write()
Date: Wed, 20 Mar 2019 12:45:23 -0400 [thread overview]
Message-ID: <5bc588d5986bbf2dfe2c7e1d59e0cdb9c262d842.1553098575.git.jaharkes@cs.cmu.edu> (raw)
In-Reply-To: <cover.1553098575.git.jaharkes@cs.cmu.edu>
Add checks to make sure the downcall message we got from the Coda cache
manager is large enough to contain the data it is supposed to have.
i.e. when we get a CODA_ZAPDIR we can access &out->coda_zapdir.CodaFid.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
---
fs/coda/psdev.c | 8 ++++++--
fs/coda/upcall.c | 34 +++++++++++++++++++++++++++++++++-
include/linux/coda_psdev.h | 3 ++-
3 files changed, 41 insertions(+), 4 deletions(-)
diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index 55824cba3245..623be0cbcba5 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -105,8 +105,12 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
ssize_t retval = 0, count = 0;
int error;
+ /* make sure there is enough to copy out the (opcode, unique) values */
+ if (nbytes < (2 * sizeof(u_int32_t)))
+ return -EINVAL;
+
/* Peek at the opcode, uniquefier */
- if (copy_from_user(&hdr, buf, 2 * sizeof(u_long)))
+ if (copy_from_user(&hdr, buf, 2 * sizeof(u_int32_t)))
return -EFAULT;
if (DOWNCALL(hdr.opcode)) {
@@ -132,7 +136,7 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
}
/* what downcall errors does Venus handle ? */
- error = coda_downcall(vcp, hdr.opcode, dcbuf);
+ error = coda_downcall(vcp, hdr.opcode, dcbuf, nbytes);
CODA_FREE(dcbuf, nbytes);
if (error) {
diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c
index 1175a1722411..cf1e662681a5 100644
--- a/fs/coda/upcall.c
+++ b/fs/coda/upcall.c
@@ -804,12 +804,44 @@ static int coda_upcall(struct venus_comm *vcp,
*
* CODA_REPLACE -- replace one CodaFid with another throughout the name cache */
-int coda_downcall(struct venus_comm *vcp, int opcode, union outputArgs *out)
+int coda_downcall(struct venus_comm *vcp, int opcode, union outputArgs *out,
+ size_t nbytes)
{
struct inode *inode = NULL;
struct CodaFid *fid = NULL, *newfid;
struct super_block *sb;
+ /*
+ * Make sure we have received enough data from the cache
+ * manager to populate the necessary fields in the buffer
+ */
+ switch (opcode) {
+ case CODA_PURGEUSER:
+ if (nbytes < sizeof(struct coda_purgeuser_out))
+ return -EINVAL;
+ break;
+
+ case CODA_ZAPDIR:
+ if (nbytes < sizeof(struct coda_zapdir_out))
+ return -EINVAL;
+ break;
+
+ case CODA_ZAPFILE:
+ if (nbytes < sizeof(struct coda_zapfile_out))
+ return -EINVAL;
+ break;
+
+ case CODA_PURGEFID:
+ if (nbytes < sizeof(struct coda_purgefid_out))
+ return -EINVAL;
+ break;
+
+ case CODA_REPLACE:
+ if (nbytes < sizeof(struct coda_replace_out))
+ return -EINVAL;
+ break;
+ }
+
/* Handle invalidation requests. */
mutex_lock(&vcp->vc_mutex);
sb = vcp->vc_sb;
diff --git a/include/linux/coda_psdev.h b/include/linux/coda_psdev.h
index 57d2b2faf6a3..d1672fd5e638 100644
--- a/include/linux/coda_psdev.h
+++ b/include/linux/coda_psdev.h
@@ -71,7 +71,8 @@ int venus_symlink(struct super_block *sb, struct CodaFid *fid,
int venus_access(struct super_block *sb, struct CodaFid *fid, int mask);
int venus_pioctl(struct super_block *sb, struct CodaFid *fid,
unsigned int cmd, struct PioctlData *data);
-int coda_downcall(struct venus_comm *vcp, int opcode, union outputArgs *out);
+int coda_downcall(struct venus_comm *vcp, int opcode, union outputArgs *out,
+ size_t nbytes);
int venus_fsync(struct super_block *sb, struct CodaFid *fid);
int venus_statfs(struct dentry *dentry, struct kstatfs *sfs);
--
2.20.1
next prev parent reply other threads:[~2019-03-20 17:27 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-20 16:45 [PATCH 00/22] Coda updates for linux-5.1 Jan Harkes
2019-03-20 16:45 ` [PATCH 01/22] uapi linux/coda.h: use __kernel_pid_t for userspace Jan Harkes
2019-03-20 16:45 ` [PATCH 02/22] uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers Jan Harkes
2019-03-20 16:45 ` [PATCH 03/22] coda: add error handling for fget Jan Harkes
2019-03-20 16:45 ` Jan Harkes [this message]
2019-03-20 16:45 ` [PATCH 05/22] coda: Fix build using bare-metal toolchain Jan Harkes
2019-03-20 16:45 ` [PATCH 06/22] coda: don't try to print names that were considered too long Jan Harkes
2019-03-20 16:45 ` [PATCH 07/22] uapi linux/coda_psdev.h: Move CODA_REQ_ from uapi to kernel side headers Jan Harkes
2019-03-20 16:45 ` [PATCH 08/22] coda: clean up indentation, replace spaces with tab Jan Harkes
2019-03-20 16:45 ` [PATCH 09/22] coda: stop using 'struct timespec' in user API Jan Harkes
2019-03-20 16:45 ` [PATCH 10/22] coda: Remove duplicate header Jan Harkes
2019-03-20 16:45 ` [PATCH 11/22] coda: change Coda's user api to use 64-bit time_t in timespec Jan Harkes
2019-03-20 16:45 ` [PATCH 12/22] coda: get rid of CODA_ALLOC() Jan Harkes
2019-03-20 16:45 ` [PATCH 13/22] coda: get rid of CODA_FREE() Jan Harkes
2019-03-20 16:45 ` [PATCH 14/22] coda: bump module version Jan Harkes
2019-03-20 16:45 ` [PATCH 15/22] coda: Move internal defs out of include/linux/ [ver #2] Jan Harkes
2019-03-20 16:45 ` [PATCH 16/22] coda: remove uapi/linux/coda_psdev.h Jan Harkes
2019-03-20 16:45 ` [PATCH 17/22] coda: destroy mutex in put_super() Jan Harkes
2019-03-20 16:45 ` [PATCH 18/22] coda: use SIZE() for stat Jan Harkes
2019-03-20 16:45 ` [PATCH 19/22] coda: add __init to init_coda_psdev() Jan Harkes
2019-03-20 16:45 ` [PATCH 20/22] coda: remove sysctl object from module when unused Jan Harkes
2019-03-20 16:45 ` [PATCH 21/22] coda: remove sb test in coda_fid_to_inode() Jan Harkes
2019-03-20 16:45 ` [PATCH 22/22] coda: ftoc validity check integration Jan Harkes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5bc588d5986bbf2dfe2c7e1d59e0cdb9c262d842.1553098575.git.jaharkes@cs.cmu.edu \
--to=jaharkes@cs.cmu.edu \
--cc=akpm@linux-foundation.org \
--cc=dan.carpenter@oracle.com \
--cc=linux-fsdevel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).