Commit ad3b904c authored Jun 06, 2012 by Xi Wang Committed by Alex Elder Jun 07, 2012

libceph: fix overflow in __decode_pool_names()



`len' is read from network and thus needs validation.  Otherwise a
large `len' would cause out-of-bounds access via the memcpy() call.
In addition, len = 0xffffffff would overflow the kmalloc() size,
leading to out-of-bounds write.

This patch adds a check of `len' via ceph_decode_need().  Also use
kstrndup rather than kmalloc/memcpy.

[elder@inktank.com: added -ENOMEM return for null kstrndup() result]

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@inktank.com>

parent 43643528

net/ceph/osdmap.c

+7 −6

Original line number	Diff line number	Diff line
		@@ -488,16 +488,17 @@ static int __decode_pool_names(void *p, void end, struct ceph_osdmap *map)
		ceph_decode_32_safe(p, end, pool, bad);
		ceph_decode_32_safe(p, end, len, bad);
		dout(" pool %d len %d\n", pool, len);
		ceph_decode_need(p, end, len, bad);
		pi = __lookup_pg_pool(&map->pg_pools, pool);
		if (pi) {
		char name = kstrndup(p, len, GFP_NOFS);

		if (!name)
		return -ENOMEM;
		kfree(pi->name);
		pi->name = kmalloc(len + 1, GFP_NOFS);
		if (pi->name) {
		memcpy(pi->name, *p, len);
		pi->name[len] = '\0';
		pi->name = name;
		dout(" name is %s\n", pi->name);
		}
		}
		*p += len;
		}
		return 0;