Prevent out of bounds reads when dealing with ACLs
Get series with b4
b4 am 1334669598.5396.7.camel@localhostVersions newest first
- v1 Latest2 patches 0 repliesNew
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | Avoid reading past buffer when calling GETACLfs/ fs/ | +21 | 0 replies | |
| 2/2 | Avoid beyond bounds copy while caching ACLfs/ | +5 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/2] Prevent out of bounds reads when dealing with ACLs
Commitbf118a342f10dafe44b14451a1392c3254629a1f
allows variable size bitmaps to be passed in the response to GETACL calls.
The patch fails in a specific condition where
bitmap array size + acl length attribute size + ACLs > PAGE_SIZE the code will read past the allocated buffer in nfs4_write_cached_acl() and in _copy_from_pages().
A simple example is if the ACL size is just less than a PAGE_SIZE but large enough so that ACL + Bitmap crosses a PAGE_SIZE, it will fail. Another example is if the server sends a large bitmap array along with smaller ACL data causing the bitmap array + ACL to go past the allocated page, it will fail again.
To test the code, we configured pynfs to append 1000 extra elements to the bitmap array which results in BITMAP+ACL size to be little over a PAGE_SIZE. This leads to a General Protection Fault in _copy_from_pages() on un-patched systems.
Sachin Prabhu (2):
Avoid reading past buffer when calling GETACL
Avoid beyond bounds copy while caching ACL
fs/nfs/nfs4proc.c | 28 +++++++++++++++------------- fs/nfs/nfs4xdr.c | 18 +++++++++++------- 2 files changed, 26 insertions(+), 20 deletions(-)
Signature · 1 line
1.7.7.6