Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2781e10 authored by Dan Carpenter's avatar Dan Carpenter Committed by J. Bruce Fields
Browse files

svcrdma: underflow issue in decode_write_list() 



My static checker marks everything from ntohl() as untrusted and it
complains we could have an underflow problem doing:

	return (u32 *)&ary->wc_array[nchunks];

Also on 32 bit systems the upper bound check could overflow.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 35f7a14f

net/sunrpc/xprtrdma/svc_rdma_marshal.c

+14 −6
Original line number Original line Diff line number Diff line
@@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch, 
 */

 */

static u32 *decode_write_list(u32 *va, u32 *vaend)

static u32 *decode_write_list(u32 *va, u32 *vaend)

{

{

	unsigned long start, end;

	int nchunks;

	int nchunks;





	struct rpcrdma_write_array *ary =

	struct rpcrdma_write_array *ary =
@@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend) 
		return NULL;

		return NULL;

	}

	}

	nchunks = ntohl(ary->wc_nchunks);

	nchunks = ntohl(ary->wc_nchunks);

	if (((unsigned long)&ary->wc_array[0] +



	     (sizeof(struct rpcrdma_write_chunk) * nchunks)) >

	start = (unsigned long)&ary->wc_array[0];

	    (unsigned long)vaend) {

	end = (unsigned long)vaend;

	if (nchunks < 0 ||

	    nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||

	    (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {

		dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",

		dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",

			ary, nchunks, vaend);

			ary, nchunks, vaend);

		return NULL;

		return NULL;
@@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend) 




static u32 *decode_reply_array(u32 *va, u32 *vaend)

static u32 *decode_reply_array(u32 *va, u32 *vaend)

{

{

	unsigned long start, end;

	int nchunks;

	int nchunks;

	struct rpcrdma_write_array *ary =

	struct rpcrdma_write_array *ary =

		(struct rpcrdma_write_array *)va;

		(struct rpcrdma_write_array *)va;
@@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend) 
		return NULL;

		return NULL;

	}

	}

	nchunks = ntohl(ary->wc_nchunks);

	nchunks = ntohl(ary->wc_nchunks);

	if (((unsigned long)&ary->wc_array[0] +



	     (sizeof(struct rpcrdma_write_chunk) * nchunks)) >

	start = (unsigned long)&ary->wc_array[0];

	    (unsigned long)vaend) {

	end = (unsigned long)vaend;

	if (nchunks < 0 ||

	    nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||

	    (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {

		dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",

		dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",

			ary, nchunks, vaend);

			ary, nchunks, vaend);

		return NULL;

		return NULL;