korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-25 05:04:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

NFS: Use correct variable for page bounds checking

Browse Source 
While decoding a secinfo reply, I store the list of supported sec
flavors on a page accessible through res->flavors.  Before reading
each new flavor, I do some math to determine if there is enough
space left on this page, and I break out of my read look if there
isn't.  In order to perform this check correctly, I need to use the
address of res->flavors, rather than the address of res.

When this loop was broken early I lied to the caller and told them
that the entire list had been decoded.  This could lead to problems
if the caller tries to use any the garbage data claiming to be a
valid sec flavor.  I fixed this by using res->flavors->num_flavors
as a counter, incrementing it every time a sec flavor is
successfully decoded.

Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
This commit is contained in:
Bryan Schumaker 2011-04-13 14:31:31 -04:00 committed by Trond Myklebust
parent 9b7160c55a
commit c3dfc2808a
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
fs/nfs/nfs4xdr.c
View File

@ -4838,17 +4838,19 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
struct nfs4_secinfo_flavor *sec_flavor;
int status;
__be32 *p;
int i;
int i, num_flavors;
status = decode_op_hdr(xdr, OP_SECINFO);
p = xdr_inline_decode(xdr, 4);
if (unlikely(!p))
goto out_overflow;
res->flavors->num_flavors = be32_to_cpup(p);
for (i = 0; i < res->flavors->num_flavors; i++) {
res->flavors->num_flavors = 0;
num_flavors = be32_to_cpup(p);
for (i = 0; i < num_flavors; i++) {
sec_flavor = &res->flavors->flavors[i];
if ((char *)&sec_flavor[1] - (char *)res > PAGE_SIZE)
if ((char *)&sec_flavor[1] - (char *)res->flavors > PAGE_SIZE)
break;
p = xdr_inline_decode(xdr, 4);
@ -4860,6 +4862,7 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
if (decode_secinfo_gss(xdr, sec_flavor))
break;
}
res->flavors->num_flavors++;
}
return 0;