Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1638122

[PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops

Show all headers | View raw

From: Colin Ian King <colin.king@canonical.com>

Array nfsd4_layout_ops has LAYOUT_TYPE_MAX elements (which is currently
just 6), so check for this upper bound rather than the hard coded upper
bound of 32 to avoid an out of bounds read on array nfsd4_layout_ops.

Detected by CoverityScan, CID#1433518 ("Out-of-bounds read")

Fixes: e79104c9bd2d26 ("nfsd: fix undefined behavior in nfsd4_layout_verify")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 fs/nfsd/nfs4proc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 1dbf62190bee..c453a1998e00 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1259,7 +1259,8 @@ nfsd4_layout_verify(struct svc_export *exp, unsigned int layout_type)
 		return NULL;
 	}
 
-	if (layout_type >= 32 || !(exp->ex_layout_types & (1 << layout_type))) {
+	if (layout_type >= LAYOUT_TYPE_MAX ||
+	    !(exp->ex_layout_types & (1 << layout_type))) {
 		dprintk("%s: layout type %d not supported\n",
 			__func__, layout_type);
 		return NULL;
-- 
2.11.0

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Colin King <colin.king@canonical.com> - 2017-05-09 15:40 +0200
  Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Dan Carpenter <dan.carpenter@oracle.com> - 2017-05-09 16:10 +0200
    Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops "J . Bruce Fields" <bfields@fieldses.org> - 2017-05-09 23:10 +0200
      Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Colin Ian King <colin.king@canonical.com> - 2017-05-09 23:20 +0200
        Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Ari Kauppi <Ari.Kauppi@synopsys.com> - 2017-05-10 07:30 +0200
  Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Christoph Hellwig <hch@infradead.org> - 2017-05-09 22:00 +0200

csiph-web