All of lore.kernel.org
 help / color / mirror / Atom feed
From: Colin King <colin.king@canonical.com>
To: Ari Kauppi <ari@synopsys.com>,
	"J . Bruce Fields" <bfields@fieldses.org>,
	Jeff Layton <jlayton@poochiereds.net>,
	linux-nfs@vger.kernel.org
Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops
Date: Tue,  9 May 2017 14:31:21 +0100	[thread overview]
Message-ID: <20170509133121.26529-1-colin.king@canonical.com> (raw)

From: Colin Ian King <colin.king@canonical.com>

Array nfsd4_layout_ops has LAYOUT_TYPE_MAX elements (which is currently
just 6), so check for this upper bound rather than the hard coded upper
bound of 32 to avoid an out of bounds read on array nfsd4_layout_ops.

Detected by CoverityScan, CID#1433518 ("Out-of-bounds read")

Fixes: e79104c9bd2d26 ("nfsd: fix undefined behavior in nfsd4_layout_verify")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 fs/nfsd/nfs4proc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 1dbf62190bee..c453a1998e00 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1259,7 +1259,8 @@ nfsd4_layout_verify(struct svc_export *exp, unsigned int layout_type)
 		return NULL;
 	}
 
-	if (layout_type >= 32 || !(exp->ex_layout_types & (1 << layout_type))) {
+	if (layout_type >= LAYOUT_TYPE_MAX ||
+	    !(exp->ex_layout_types & (1 << layout_type))) {
 		dprintk("%s: layout type %d not supported\n",
 			__func__, layout_type);
 		return NULL;
-- 
2.11.0

WARNING: multiple messages have this Message-ID (diff)
From: Colin King <colin.king@canonical.com>
To: Ari Kauppi <ari@synopsys.com>,
	"J . Bruce Fields" <bfields@fieldses.org>,
	Jeff Layton <jlayton@poochiereds.net>,
	linux-nfs@vger.kernel.org
Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops
Date: Tue, 09 May 2017 13:31:21 +0000	[thread overview]
Message-ID: <20170509133121.26529-1-colin.king@canonical.com> (raw)

From: Colin Ian King <colin.king@canonical.com>

Array nfsd4_layout_ops has LAYOUT_TYPE_MAX elements (which is currently
just 6), so check for this upper bound rather than the hard coded upper
bound of 32 to avoid an out of bounds read on array nfsd4_layout_ops.

Detected by CoverityScan, CID#1433518 ("Out-of-bounds read")

Fixes: e79104c9bd2d26 ("nfsd: fix undefined behavior in nfsd4_layout_verify")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 fs/nfsd/nfs4proc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 1dbf62190bee..c453a1998e00 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1259,7 +1259,8 @@ nfsd4_layout_verify(struct svc_export *exp, unsigned int layout_type)
 		return NULL;
 	}
 
-	if (layout_type >= 32 || !(exp->ex_layout_types & (1 << layout_type))) {
+	if (layout_type >= LAYOUT_TYPE_MAX ||
+	    !(exp->ex_layout_types & (1 << layout_type))) {
 		dprintk("%s: layout type %d not supported\n",
 			__func__, layout_type);
 		return NULL;
-- 
2.11.0


             reply	other threads:[~2017-05-09 13:31 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-05-09 13:31 Colin King [this message]
2017-05-09 13:31 ` [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Colin King
2017-05-09 14:04 ` Dan Carpenter
2017-05-09 14:04   ` Dan Carpenter
2017-05-09 21:03   ` J . Bruce Fields
2017-05-09 21:03     ` J . Bruce Fields
2017-05-09 21:14     ` Colin Ian King
2017-05-09 21:14       ` Colin Ian King
2017-05-10  5:24       ` Ari Kauppi
2017-05-09 19:57 ` Christoph Hellwig
2017-05-09 19:57   ` Christoph Hellwig

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170509133121.26529-1-colin.king@canonical.com \
    --to=colin.king@canonical.com \
    --cc=ari@synopsys.com \
    --cc=bfields@fieldses.org \
    --cc=jlayton@poochiereds.net \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-nfs@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.