From patchwork Tue Jun 27 12:16:35 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Po-Hsu Lin X-Patchwork-Id: 781185 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3wxlKX42bkz9s2s; Tue, 27 Jun 2017 22:17:04 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical-com.20150623.gappssmtp.com header.i=@canonical-com.20150623.gappssmtp.com header.b="qOddBG0N"; dkim-atps=neutral Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1dPpQT-0005Vu-Nk; Tue, 27 Jun 2017 12:17:01 +0000 Received: from mail-pg0-f51.google.com ([74.125.83.51]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1dPpQJ-0005TB-Re for kernel-team@lists.ubuntu.com; Tue, 27 Jun 2017 12:16:51 +0000 Received: by mail-pg0-f51.google.com with SMTP id f127so15008922pgc.0 for ; Tue, 27 Jun 2017 05:16:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id:in-reply-to:references; bh=1jIVD3X0oxaKziftpJklFnvbFilCNv0j6l9/ibmqa+E=; b=qOddBG0N4sCW7jIYzTfIvGcqNnlTMeseK0jHozKdDQhRNtvpLkACHpFlzFDiGO6XWE BQf40rfxSUE6+G4twGMDCOmdjFB3atnXnUiwJOj4iy32cyrndP4fOMKuzTrLn4tYo7Dm mwFbIDtbIOEZM80cBOajhbBrAjfbQSDDATTZ/f4UFYKFA+uYaZqgry3nUWnakY13jMcK fsGRboN2NN81+plxgz3oMEked6FS7f5sZbTqrKrdCXO2Oo0UBw1MGmdTwiTrpe9Y90QW 02W6ZNfIE6LOIH/ExmyqL3grTYtQOUdHzEvhX48+WfhKsMoTpgsfdJCFXp9xJSfLlkFw N3Kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=1jIVD3X0oxaKziftpJklFnvbFilCNv0j6l9/ibmqa+E=; b=Jh1cum7DR6y6MxO9sBB6zv5r04i8zn2ZtXTyibQicV9EPQK33OwVNUuvp8cbRK5KML llxtIh5z7ztU46kr6z11WN77mzyOyjF+PlCqs8RJYALjqjLmkAPY+IuuWoBd3CS8OWIL EQzq2Z/ylRai61rCnZebC5a+Mo7v4jMSQ37gxjl5XGBfk+WCNOJ6lYc2mPvxpIrWZjI5 RsQwbJLk8lO6GcFo/D5PRA3g3ZcNkm2BA5WuV3OEg0uKiwN5NCDil+pW0g9FHNura/SR Ei/EIIzuk87Oc+GQgwyArvYEMLKYxXQL87a0jyV2d2J9ssjyJQNlKRT6E3rkh9qOWh6N GRjQ== X-Gm-Message-State: AKS2vOya4Mg14uDsH6kC79C6a+wRmQ0uRxBm5N5qPcIGdPC5j6wRKl8e b8dShoE0pG8bVgsAX0k= X-Received: by 10.84.229.6 with SMTP id b6mr5351761plk.247.1498565810360; Tue, 27 Jun 2017 05:16:50 -0700 (PDT) Received: from localhost.localdomain ([175.41.48.77]) by smtp.gmail.com with ESMTPSA id s62sm2540947pfi.36.2017.06.27.05.16.49 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 Jun 2017 05:16:49 -0700 (PDT) From: Po-Hsu Lin To: kernel-team@lists.ubuntu.com Subject: [CVE-2017-7895][T][PATCH 3/4] nfsd4: minor NFSv2/v3 write decoding cleanup Date: Tue, 27 Jun 2017 20:16:35 +0800 Message-Id: <1498565798-19727-4-git-send-email-po-hsu.lin@canonical.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1498565798-19727-1-git-send-email-po-hsu.lin@canonical.com> References: <1498565798-19727-1-git-send-email-po-hsu.lin@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: "J. Bruce Fields" CVE-2017-7895 Use a couple shortcuts that will simplify a following bugfix. Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields (cherry picked from commit db44bac41bbfc0c0d9dd943092d8bded3c9db19b) Signed-off-by: Po-Hsu Lin --- fs/nfsd/nfs3xdr.c | 9 +++++---- fs/nfsd/nfsxdr.c | 8 ++++---- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c index e848abd..c593959 100644 --- a/fs/nfsd/nfs3xdr.c +++ b/fs/nfsd/nfs3xdr.c @@ -363,6 +363,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, { unsigned int len, v, hdr, dlen; u32 max_blocksize = svc_max_payload(rqstp); + struct kvec *head = rqstp->rq_arg.head; + struct kvec *tail = rqstp->rq_arg.tail; p = decode_fh(p, &args->fh); if (!p) @@ -382,9 +384,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, * Check to make sure that we got the right number of * bytes. */ - hdr = (void*)p - rqstp->rq_arg.head[0].iov_base; - dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len - + rqstp->rq_arg.tail[0].iov_len - hdr; + hdr = (void*)p - head->iov_base; + dlen = head->iov_len + rqstp->rq_arg.page_len + tail->iov_len - hdr; /* * Round the length of the data which was specified up to * the next multiple of XDR units and then compare that @@ -401,7 +402,7 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, len = args->len = max_blocksize; } rqstp->rq_vec[0].iov_base = (void*)p; - rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr; + rqstp->rq_vec[0].iov_len = head->iov_len - hdr; v = 0; while (len > rqstp->rq_vec[v].iov_len) { len -= rqstp->rq_vec[v].iov_len; diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c index 1ac306b..bee5d99 100644 --- a/fs/nfsd/nfsxdr.c +++ b/fs/nfsd/nfsxdr.c @@ -281,6 +281,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd_writeargs *args) { unsigned int len, hdr, dlen; + struct kvec *head = rqstp->rq_arg.head; int v; p = decode_fh(p, &args->fh); @@ -301,9 +302,8 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, * Check to make sure that we got the right number of * bytes. */ - hdr = (void*)p - rqstp->rq_arg.head[0].iov_base; - dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len - - hdr; + hdr = (void*)p - head->iov_base; + dlen = head->iov_len + rqstp->rq_arg.page_len - hdr; /* * Round the length of the data which was specified up to @@ -317,7 +317,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, return 0; rqstp->rq_vec[0].iov_base = (void*)p; - rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr; + rqstp->rq_vec[0].iov_len = head->iov_len - hdr; v = 0; while (len > rqstp->rq_vec[v].iov_len) { len -= rqstp->rq_vec[v].iov_len;