Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops

From	Ari Kauppi <Ari.Kauppi@synopsys.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops
Date	2017-05-10 07:30 +0200
Message-ID	<tFsmd-543-3@gated-at.bofh.it> (permalink)
References	<tFdwS-2iO-13@gated-at.bofh.it> <tFdZU-2JX-3@gated-at.bofh.it> <tFkym-7gI-7@gated-at.bofh.it> <tFkI1-7kb-13@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

> On 10.5.2017, at 0.14, Colin Ian King <colin.king@canonical.com> wrote:
> 
> On 09/05/17 22:03, J . Bruce Fields wrote:
>> On Tue, May 09, 2017 at 05:04:14PM +0300, Dan Carpenter wrote:
>>> On Tue, May 09, 2017 at 02:31:21PM +0100, Colin King wrote:
>>>> diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
>>>> index 1dbf62190bee..c453a1998e00 100644
>>>> --- a/fs/nfsd/nfs4proc.c
>>>> +++ b/fs/nfsd/nfs4proc.c
>>>> @@ -1259,7 +1259,8 @@ nfsd4_layout_verify(struct svc_export *exp, unsigned int layout_type)
>>>> 		return NULL;
>>>> 	}
>>>> 
>>>> -	if (layout_type >= 32 || !(exp->ex_layout_types & (1 << layout_type))) {
>>>> +	if (layout_type >= LAYOUT_TYPE_MAX ||
>>>> +	    !(exp->ex_layout_types & (1 << layout_type))) {
>>> 
>>> The 32 is there to prevent a shift wrapping bug.  The bit test prevents
>>> a buffer overflow so this can't actually overflow.
>> 
>> Yes, looks like a false positive for coverity.
>> 
>>> But this change doesn't hurt and is probably cleaner.
>> 
>> Sure.  Hope it's OK if I just merge this into the previous commit:
> 
> Fine by me.  Colin

Looks good to me.

Thanks,

--
Ari

Thread

[PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Colin King <colin.king@canonical.com> - 2017-05-09 15:40 +0200
  Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Dan Carpenter <dan.carpenter@oracle.com> - 2017-05-09 16:10 +0200
    Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops "J . Bruce Fields" <bfields@fieldses.org> - 2017-05-09 23:10 +0200
      Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Colin Ian King <colin.king@canonical.com> - 2017-05-09 23:20 +0200
        Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Ari Kauppi <Ari.Kauppi@synopsys.com> - 2017-05-10 07:30 +0200
  Re: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops Christoph Hellwig <hch@infradead.org> - 2017-05-09 22:00 +0200

csiph-web