d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nfsd: Add a sanity check for Owner/OwnerGroup string length

Browse Source 
Robert Morris reported that, if a client sends an absurdly
large Owner/OwnerGroup string, the kernel malloc() for the
large size string can block forever.

This patch adds a sanity limit for Owner/OwnerGroup string
length.  Since the RFCs do not specify any limit and FreeBSD
can handle a group name greater than 1Kbyte, the limit is
set at a generous 10Kbytes.

Reported by:	rtm@lcs.mit.edu
PR:	260546
MFC after:	2 weeks
This commit is contained in:
Rick Macklem 2022-05-04 13:58:22 -07:00
parent f32bf50d43
commit ef4edb70c9
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/fs/nfs/nfs.h
View File

@ -143,6 +143,13 @@
#define NFS_READDIRBLKSIZ DIRBLKSIZ /* Minimal nm_readdirsize */
/*
* The NFSv4 RFCs do not define an upper limit on the length of Owner and
* OwnerGroup strings. Since FreeBSD handles a group name > 1024bytes in
* length, set a generous sanity limit of 10Kbytes.
*/
#define NFSV4_MAXOWNERGROUPLEN (10 * 1024)
/*
* Oddballs
*/

4
sys/fs/nfs/nfs_commonsubs.c
View File

@ -1843,7 +1843,7 @@ nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp,
case NFSATTRBIT_OWNER:
NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
j = fxdr_unsigned(int, *tl);
if (j < 0) {
if (j < 0 || j > NFSV4_MAXOWNERGROUPLEN) {
error = NFSERR_BADXDR;
goto nfsmout;
}
@ -1876,7 +1876,7 @@ nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp,
case NFSATTRBIT_OWNERGROUP:
NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
j = fxdr_unsigned(int, *tl);
if (j < 0) {
if (j < 0 || j > NFSV4_MAXOWNERGROUPLEN) {
error = NFSERR_BADXDR;
goto nfsmout;
}