iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

svcrdma: underflow issue in decode_write_list()

Browse Source 
My static checker marks everything from ntohl() as untrusted and it
complains we could have an underflow problem doing:

	return (u32 *)&ary->wc_array[nchunks];

Also on 32 bit systems the upper bound check could overflow.

Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
Dan Carpenter
2013-07-12 09:39:03 +03:00
committed by J. Bruce Fields
parent 35f7a14fc1
commit b2781e1021
1 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
net/sunrpc/xprtrdma/svc_rdma_marshal.c
View File

@@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch,
*/ */
static u32 *decode_write_list(u32 *va, u32 *vaend) static u32 *decode_write_list(u32 *va, u32 *vaend)
{ {
unsigned long start, end;
int nchunks; int nchunks;
struct rpcrdma_write_array *ary = struct rpcrdma_write_array *ary =
@@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
return NULL; return NULL;
} }
nchunks = ntohl(ary->wc_nchunks); nchunks = ntohl(ary->wc_nchunks);
if (((unsigned long)&ary->wc_array[0] +
(sizeof(struct rpcrdma_write_chunk) * nchunks)) > start = (unsigned long)&ary->wc_array[0];
(unsigned long)vaend) { end = (unsigned long)vaend;
if (nchunks < 0 ||
nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
(start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n", dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
ary, nchunks, vaend); ary, nchunks, vaend);
return NULL; return NULL;
@@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
static u32 *decode_reply_array(u32 *va, u32 *vaend) static u32 *decode_reply_array(u32 *va, u32 *vaend)
{ {
unsigned long start, end;
int nchunks; int nchunks;
struct rpcrdma_write_array *ary = struct rpcrdma_write_array *ary =
(struct rpcrdma_write_array *)va; (struct rpcrdma_write_array *)va;
@@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend)
return NULL; return NULL;
} }
nchunks = ntohl(ary->wc_nchunks); nchunks = ntohl(ary->wc_nchunks);
if (((unsigned long)&ary->wc_array[0] +
(sizeof(struct rpcrdma_write_chunk) * nchunks)) > start = (unsigned long)&ary->wc_array[0];
(unsigned long)vaend) { end = (unsigned long)vaend;
if (nchunks < 0 ||
nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
(start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n", dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
ary, nchunks, vaend); ary, nchunks, vaend);
return NULL; return NULL;