hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rbd: fix integer overflow in rbd_header_from_disk() 

ondisk->snap_count is read from disk via rbd_req_sync_read() and thus
needs validation.  Otherwise, a bogus `snap_count' could overflow the
kmalloc() size, leading to memory corruption.

Also use `u32' consistently for `snap_count'.

[elder@dreamhost.com: changed to use UINT_MAX rather than ULONG_MAX]

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@dreamhost.com>
This commit is contained in:
Xi Wang 2012-04-20 15:49:44 -05:00 committed by Alex Elder
parent f8ad495a8a
commit 50f7c4c967
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/block/rbd.c
View File

@ -487,16 +487,18 @@ static void rbd_coll_release(struct kref *kref)
*/ */
static int rbd_header_from_disk(struct rbd_image_header *header, static int rbd_header_from_disk(struct rbd_image_header *header,
struct rbd_image_header_ondisk *ondisk, struct rbd_image_header_ondisk *ondisk,
int allocated_snaps, u32 allocated_snaps,
gfp_t gfp_flags) gfp_t gfp_flags)
{ {
int i; u32 i, snap_count;
u32 snap_count;
if (memcmp(ondisk, RBD_HEADER_TEXT, sizeof(RBD_HEADER_TEXT))) if (memcmp(ondisk, RBD_HEADER_TEXT, sizeof(RBD_HEADER_TEXT)))
return -ENXIO; return -ENXIO;
snap_count = le32_to_cpu(ondisk->snap_count); snap_count = le32_to_cpu(ondisk->snap_count);
if (snap_count > (UINT_MAX - sizeof(struct ceph_snap_context))
/ sizeof (*ondisk))
return -EINVAL;
header->snapc = kmalloc(sizeof(struct ceph_snap_context) + header->snapc = kmalloc(sizeof(struct ceph_snap_context) +
snap_count * sizeof (*ondisk), snap_count * sizeof (*ondisk),
gfp_flags); gfp_flags);
@ -1591,7 +1593,7 @@ static int rbd_read_header(struct rbd_device *rbd_dev,
{ {
ssize_t rc; ssize_t rc;
struct rbd_image_header_ondisk *dh; struct rbd_image_header_ondisk *dh;
int snap_count = 0; u32 snap_count = 0;
u64 ver; u64 ver;
size_t len; size_t len;