Commit b2781e10 authored by Dan Carpenter's avatar Dan Carpenter Committed by J. Bruce Fields

svcrdma: underflow issue in decode_write_list()

My static checker marks everything from ntohl() as untrusted and it
complains we could have an underflow problem doing:

	return (u32 *)&ary->wc_array[nchunks];

Also on 32 bit systems the upper bound check could overflow.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 35f7a14f
...@@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch, ...@@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch,
*/ */
static u32 *decode_write_list(u32 *va, u32 *vaend) static u32 *decode_write_list(u32 *va, u32 *vaend)
{ {
unsigned long start, end;
int nchunks; int nchunks;
struct rpcrdma_write_array *ary = struct rpcrdma_write_array *ary =
...@@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend) ...@@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
return NULL; return NULL;
} }
nchunks = ntohl(ary->wc_nchunks); nchunks = ntohl(ary->wc_nchunks);
if (((unsigned long)&ary->wc_array[0] +
(sizeof(struct rpcrdma_write_chunk) * nchunks)) > start = (unsigned long)&ary->wc_array[0];
(unsigned long)vaend) { end = (unsigned long)vaend;
if (nchunks < 0 ||
nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
(start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n", dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
ary, nchunks, vaend); ary, nchunks, vaend);
return NULL; return NULL;
...@@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend) ...@@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
static u32 *decode_reply_array(u32 *va, u32 *vaend) static u32 *decode_reply_array(u32 *va, u32 *vaend)
{ {
unsigned long start, end;
int nchunks; int nchunks;
struct rpcrdma_write_array *ary = struct rpcrdma_write_array *ary =
(struct rpcrdma_write_array *)va; (struct rpcrdma_write_array *)va;
...@@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend) ...@@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend)
return NULL; return NULL;
} }
nchunks = ntohl(ary->wc_nchunks); nchunks = ntohl(ary->wc_nchunks);
if (((unsigned long)&ary->wc_array[0] +
(sizeof(struct rpcrdma_write_chunk) * nchunks)) > start = (unsigned long)&ary->wc_array[0];
(unsigned long)vaend) { end = (unsigned long)vaend;
if (nchunks < 0 ||
nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
(start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n", dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
ary, nchunks, vaend); ary, nchunks, vaend);
return NULL; return NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment