d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nfsd: Fix sanity check for NFSv4.2 Allocate operations

Browse Source 
The NFSv4.2 Allocate operation sanity checks the aa_offset
and aa_length arguments.  Since they are assigned to variables
of type off_t (signed) it was possible for them to be negative.
It was also possible for aa_offset+aa_length to exceed OFF_MAX
when stored in lo_end, which is uint64_t.

This patch adds checks for these cases to the sanity check.

Reviewed by:	kib
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D31511
This commit is contained in:
Rick Macklem 2021-08-12 16:48:28 -07:00
parent 5ff5d1177b
commit 06afb53bcd
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/fs/nfsserver/nfs_nfsdserv.c
View File

@ -5347,12 +5347,18 @@ nfsrvd_allocate(struct nfsrv_descript *nd, __unused int isdgram,
off = fxdr_hyper(tl); tl += 2;
lop->lo_first = off;
len = fxdr_hyper(tl);
lop->lo_end = off + len;
lop->lo_end = lop->lo_first + len;
/*
* Paranoia, just in case it wraps around, which shouldn't
* ever happen anyhow.
* Sanity check the offset and length.
* off and len are off_t (signed int64_t) whereas
* lo_first and lo_end are uint64_t and, as such,
* if off >= 0 && len > 0, lo_end cannot overflow
* unless off_t is changed to something other than
* int64_t. Check lo_end < lo_first in case that
* is someday the case.
*/
if (nd->nd_repstat == 0 && (lop->lo_end < lop->lo_first || len <= 0))
if (nd->nd_repstat == 0 && (len <= 0 || off < 0 || lop->lo_end >
OFF_MAX || lop->lo_end < lop->lo_first))
nd->nd_repstat = NFSERR_INVAL;
if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)