lkml.org 
[lkml]   [2021]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 23/54] NFS: fix an incorrect limit in filelayout_decode_layout()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 769b01ea68b6c49dc3cde6adf7e53927dacbd3a8 upstream.

    The "sizeof(struct nfs_fh)" is two bytes too large and could lead to
    memory corruption. It should be NFS_MAXFHSIZE because that's the size
    of the ->data[] buffer.

    I reversed the size of the arguments to put the variable on the left.

    Fixes: 16b374ca439f ("NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/nfs/filelayout/filelayout.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/nfs/filelayout/filelayout.c
    +++ b/fs/nfs/filelayout/filelayout.c
    @@ -716,7 +716,7 @@ filelayout_decode_layout(struct pnfs_lay
    if (unlikely(!p))
    goto out_err;
    fl->fh_array[i]->size = be32_to_cpup(p++);
    - if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) {
    + if (fl->fh_array[i]->size > NFS_MAXFHSIZE) {
    printk(KERN_ERR "NFS: Too big fh %d received %d\n",
    i, fl->fh_array[i]->size);
    goto out_err;

    \
     
     \ /
      Last update: 2021-05-31 15:18    [W:4.161 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site