From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Trond Myklebust <trond.myklebust@hammerspace.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 54/63] NFSv4.2: Dont error when exiting early on a READ_PLUS buffer overflow
Date: Mon, 4 Jan 2021 16:57:47 +0100 [thread overview]
Message-ID: <20210104155711.434974524@linuxfoundation.org> (raw)
In-Reply-To: <20210104155708.800470590@linuxfoundation.org>
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 503b934a752f7e789a5f33217520e0a79f3096ac ]
Expanding the READ_PLUS extents can cause the read buffer to overflow.
If it does, then don't error, but just exit early.
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs42xdr.c | 36 +++++++++++++++++-------------------
1 file changed, 17 insertions(+), 19 deletions(-)
diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
index 8432bd6b95f08..c078f88552695 100644
--- a/fs/nfs/nfs42xdr.c
+++ b/fs/nfs/nfs42xdr.c
@@ -1019,29 +1019,24 @@ static int decode_deallocate(struct xdr_stream *xdr, struct nfs42_falloc_res *re
return decode_op_hdr(xdr, OP_DEALLOCATE);
}
-static int decode_read_plus_data(struct xdr_stream *xdr, struct nfs_pgio_res *res,
- uint32_t *eof)
+static int decode_read_plus_data(struct xdr_stream *xdr,
+ struct nfs_pgio_res *res)
{
uint32_t count, recvd;
uint64_t offset;
__be32 *p;
p = xdr_inline_decode(xdr, 8 + 4);
- if (unlikely(!p))
- return -EIO;
+ if (!p)
+ return 1;
p = xdr_decode_hyper(p, &offset);
count = be32_to_cpup(p);
recvd = xdr_align_data(xdr, res->count, count);
res->count += recvd;
- if (count > recvd) {
- dprintk("NFS: server cheating in read reply: "
- "count %u > recvd %u\n", count, recvd);
- *eof = 0;
+ if (count > recvd)
return 1;
- }
-
return 0;
}
@@ -1052,18 +1047,16 @@ static int decode_read_plus_hole(struct xdr_stream *xdr, struct nfs_pgio_res *re
__be32 *p;
p = xdr_inline_decode(xdr, 8 + 8);
- if (unlikely(!p))
- return -EIO;
+ if (!p)
+ return 1;
p = xdr_decode_hyper(p, &offset);
p = xdr_decode_hyper(p, &length);
recvd = xdr_expand_hole(xdr, res->count, length);
res->count += recvd;
- if (recvd < length) {
- *eof = 0;
+ if (recvd < length)
return 1;
- }
return 0;
}
@@ -1088,12 +1081,12 @@ static int decode_read_plus(struct xdr_stream *xdr, struct nfs_pgio_res *res)
for (i = 0; i < segments; i++) {
p = xdr_inline_decode(xdr, 4);
- if (unlikely(!p))
- return -EIO;
+ if (!p)
+ goto early_out;
type = be32_to_cpup(p++);
if (type == NFS4_CONTENT_DATA)
- status = decode_read_plus_data(xdr, res, &eof);
+ status = decode_read_plus_data(xdr, res);
else if (type == NFS4_CONTENT_HOLE)
status = decode_read_plus_hole(xdr, res, &eof);
else
@@ -1102,12 +1095,17 @@ static int decode_read_plus(struct xdr_stream *xdr, struct nfs_pgio_res *res)
if (status < 0)
return status;
if (status > 0)
- break;
+ goto early_out;
}
out:
res->eof = eof;
return 0;
+early_out:
+ if (unlikely(!i))
+ return -EIO;
+ res->eof = 0;
+ return 0;
}
static int decode_seek(struct xdr_stream *xdr, struct nfs42_seek_res *res)
--
2.27.0
next prev parent reply other threads:[~2021-01-04 16:05 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-04 15:56 [PATCH 5.10 00/63] 5.10.5-rc1 review Greg Kroah-Hartman
2021-01-04 15:56 ` [PATCH 5.10 01/63] net/sched: sch_taprio: reset child qdiscs before freeing them Greg Kroah-Hartman
2021-01-04 22:58 ` Sasha Levin
2021-01-04 23:06 ` Jakub Kicinski
2021-01-04 15:56 ` [PATCH 5.10 02/63] mptcp: fix security context on server socket Greg Kroah-Hartman
2021-01-04 15:56 ` [PATCH 5.10 03/63] ethtool: fix error paths in ethnl_set_channels() Greg Kroah-Hartman
2021-01-04 15:56 ` [PATCH 5.10 04/63] ethtool: fix string set id check Greg Kroah-Hartman
2021-01-04 15:56 ` [PATCH 5.10 05/63] md/raid10: initialize r10_bio->read_slot before use Greg Kroah-Hartman
2021-01-04 15:56 ` [PATCH 5.10 06/63] drm/amd/display: Add get_dig_frontend implementation for DCEx Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 07/63] io_uring: close a small race gap for files cancel Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 08/63] jffs2: Allow setting rp_size to zero during remounting Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 09/63] jffs2: Fix NULL pointer dereference in rp_size fs option parsing Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 10/63] spi: dw-bt1: Fix undefined devm_mux_control_get symbol Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 11/63] opp: fix memory leak in _allocate_opp_table Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 12/63] opp: Call the missing clk_put() on error Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 13/63] scsi: block: Fix a race in the runtime power management code Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 14/63] mm/hugetlb: fix deadlock in hugetlb_cow error path Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 15/63] mm: memmap defer init doesnt work as expected Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 16/63] lib/zlib: fix inflating zlib streams on s390 Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 17/63] io_uring: dont assume mm is constant across submits Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 18/63] io_uring: use bottom half safe lock for fixed file data Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 19/63] io_uring: add a helper for setting a ref node Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 20/63] io_uring: fix io_sqe_files_unregister() hangs Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 21/63] kernel/io_uring: cancel io_uring before task works Greg Kroah-Hartman
2021-01-04 16:06 ` Pavel Begunkov
2021-01-04 17:43 ` Sasha Levin
2021-01-04 15:57 ` [PATCH 5.10 22/63] uapi: move constants from <linux/kernel.h> to <linux/const.h> Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 23/63] tools headers UAPI: Sync linux/const.h with the kernel headers Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 24/63] cgroup: Fix memory leak when parsing multiple source parameters Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 25/63] zlib: move EXPORT_SYMBOL() and MODULE_LICENSE() out of dfltcc_syms.c Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 26/63] scsi: cxgb4i: Fix TLS dependency Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 27/63] Bluetooth: hci_h5: close serdev device and free hu in h5_close Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 28/63] fbcon: Disable accelerated scrolling Greg Kroah-Hartman
2021-01-07 8:13 ` Geert Uytterhoeven
2021-01-04 15:57 ` [PATCH 5.10 29/63] reiserfs: add check for an invalid ih_entry_count Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 30/63] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 31/63] media: gp8psk: initialize stats at power control logic Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 32/63] f2fs: fix shift-out-of-bounds in sanity_check_raw_super() Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 33/63] ALSA: seq: Use bool for snd_seq_queue internal flags Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 34/63] ALSA: rawmidi: Access runtime->avail always in spinlock Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 35/63] bfs: dont use WARNING: string when its just info Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 36/63] ext4: check for invalid block size early when mounting a file system Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 37/63] fcntl: Fix potential deadlock in send_sig{io, urg}() Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 38/63] io_uring: check kthread stopped flag when sq thread is unparked Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 39/63] rtc: sun6i: Fix memleak in sun6i_rtc_clk_init Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 40/63] module: set MODULE_STATE_GOING state when a module fails to load Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 41/63] quota: Dont overflow quota file offsets Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 42/63] rtc: pl031: fix resource leak in pl031_probe Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 43/63] powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 44/63] i3c master: fix missing destroy_workqueue() on error in i3c_master_register Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 45/63] NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 46/63] f2fs: avoid race condition for shrinker count Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 47/63] f2fs: fix race of pending_pages in decompression Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 48/63] module: delay kobject uevent until after module init call Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 49/63] powerpc/64: irq replay remove decrementer overflow check Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 50/63] fs/namespace.c: WARN if mnt_count has become negative Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 51/63] watchdog: rti-wdt: fix reference leak in rti_wdt_probe Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 52/63] um: random: Register random as hwrng-core device Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 53/63] um: ubd: Submit all data segments atomically Greg Kroah-Hartman
2021-01-04 15:57 ` Greg Kroah-Hartman [this message]
2021-01-04 15:57 ` [PATCH 5.10 55/63] ceph: fix inode refcount leak when ceph_fill_inode on non-I_NEW inode fails Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 56/63] drm/amd/display: updated wm table for Renoir Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 57/63] tick/sched: Remove bogus boot "safety" check Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 58/63] s390: always clear kernel stack backchain before calling functions Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 59/63] io_uring: remove racy overflow list fast checks Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 60/63] ALSA: pcm: Clear the full allocated memory at hw_params Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 61/63] dm verity: skip verity work if I/O error when system is shutting down Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 62/63] ext4: avoid s_mb_prefetch to be zero in individual scenarios Greg Kroah-Hartman
2021-01-04 15:57 ` [PATCH 5.10 63/63] device-dax: Fix range release Greg Kroah-Hartman
2021-01-05 6:06 ` [PATCH 5.10 00/63] 5.10.5-rc1 review Daniel Díaz
2021-01-05 12:55 ` Jeffrin Jose T
2021-01-05 13:05 ` Greg Kroah-Hartman
2021-01-06 18:43 ` Jeffrin Jose T
2021-01-05 16:38 ` Shuah Khan
2021-01-05 18:17 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210104155711.434974524@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=trond.myklebust@hammerspace.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).