From patchwork Thu Dec 16 20:06:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1569374 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=Oxyy1BqJ; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4JFNT4699Tz9tD5 for ; Fri, 17 Dec 2021 07:07:51 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1mxx2O-0007oA-Cd; Thu, 16 Dec 2021 20:07:36 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1mxx2N-0007o3-FI for kernel-team@lists.ubuntu.com; Thu, 16 Dec 2021 20:07:35 +0000 Received: from mussarela.. (unknown [179.93.189.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id 8AEA73F125 for ; Thu, 16 Dec 2021 20:07:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1639685255; bh=tsnuyF49EnNhEFIaNr1h25+7iP2S7tCjxGLvPDQzT+g=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=Oxyy1BqJoYWwjx6dH+O5T6+TpF8/3JKkQ41LORvxKOAAAsLmOuFSVy8LuloFuGQmV Ggrd1lmgjXbAZrr8xql5CRjeSSOaBPmXIeEsxFxLHLOXCoF3YujqDeIkoltj8w6AXL BQ1KkOfQEIWM81/G+Fm/7kaohzjTVUQsL2fedWJ3OouYsvG4pjXWm/uVQccZwSfXQq uUtTLmQgQ0vHVGE1TdhcjVBRi3y7P0uaexfPHEge5jClXZH/jVXi09y2ED6SnxAbp6 oV+gar4+B7HIkU8ZWhbqSexnqJwo+12FgsjWFAKb2c45bWjmK24VJO4d0/WEs5C/5o CnYGST7mQ1ngw== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU H/I/OEM-5.14] NFSD: Fix exposure in nfsd4_decode_bitmap() Date: Thu, 16 Dec 2021 17:06:38 -0300 Message-Id: <20211216200638.935463-1-cascardo@canonical.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Chuck Lever rtm@csail.mit.edu reports: > nfsd4_decode_bitmap4() will write beyond bmval[bmlen-1] if the RPC > directs it to do so. This can cause nfsd4_decode_state_protect4_a() > to write client-supplied data beyond the end of > nfsd4_exchange_id.spo_must_allow[] when called by > nfsd4_decode_exchange_id(). Rewrite the loops so nfsd4_decode_bitmap() cannot iterate beyond @bmlen. Reported by: rtm@csail.mit.edu Fixes: d1c263a031e8 ("NFSD: Replace READ* macros in nfsd4_decode_fattr()") Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields (cherry picked from commit c0019b7db1d7ac62c711cda6b357a659d46428fe) CVE-2021-4090 Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Tim Gardner Acked-by: Kelsey Skunberg --- fs/nfsd/nfs4xdr.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index be64d3f5e411..0017da5bf23f 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -288,11 +288,8 @@ nfsd4_decode_bitmap4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen) p = xdr_inline_decode(argp->xdr, count << 2); if (!p) return nfserr_bad_xdr; - i = 0; - while (i < count) - bmval[i++] = be32_to_cpup(p++); - while (i < bmlen) - bmval[i++] = 0; + for (i = 0; i < bmlen; i++) + bmval[i] = (i < count) ? be32_to_cpup(p++) : 0; return nfs_ok; }