From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eu-smtp-delivery-151.mimecast.com (eu-smtp-delivery-151.mimecast.com [185.58.86.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57B5642A81 for ; Mon, 9 Sep 2024 11:34:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.58.86.151 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725881644; cv=none; b=AjsGy4Ajdin3U2XKEHqkw7bqEFkf2W6ZhkxI2xYAwiq4IlnKvfyUfcd/GDhYrnp6uD6mPLvnea99oaN56ECykrdqQ7+tIKGZXJhd8BbnCWzbWr6E2p/uuzvPf7dYV+tQbe39MsGqjHBRYEWBD3iEcAfgr7es4+WDe6fwrFdHH+4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725881644; c=relaxed/simple; bh=R1nya6Eo+iPzdodCYDnS0daVSwPndrpQ5/s2bM2RmuE=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: MIME-Version:Content-Type; b=hilx6H58qTC4RXFg/2IaHHRvVhEKXavcasq/C4apcGNUUEixFjxS4ShhBqIQIk8vSnyBZ/00VAxjDR9g1pri0wWifetdAcIjbLpuJlAW/McG/7AIPuWWLFuVUMGny7Ll5VCxcbUEnxDsmnnDvB4b4qvT+mL5NKovae8+1ZvlNz4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ACULAB.COM; spf=pass smtp.mailfrom=aculab.com; arc=none smtp.client-ip=185.58.86.151 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ACULAB.COM Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=aculab.com Received: from AcuMS.aculab.com (156.67.243.121 [156.67.243.121]) by relay.mimecast.com with ESMTP with both STARTTLS and AUTH (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id uk-mta-277-H4Bn3nZzNZ6V0rqbRnoiOA-1; Mon, 09 Sep 2024 12:33:58 +0100 X-MC-Unique: H4Bn3nZzNZ6V0rqbRnoiOA-1 Received: from AcuMS.Aculab.com (10.202.163.6) by AcuMS.aculab.com (10.202.163.6) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Mon, 9 Sep 2024 12:33:04 +0100 Received: from AcuMS.Aculab.com ([::1]) by AcuMS.aculab.com ([::1]) with mapi id 15.00.1497.048; Mon, 9 Sep 2024 12:33:04 +0100 From: David Laight To: 'Scott Mayhew' CC: Li Lingfeng , "chuck.lever@oracle.com" , "jlayton@kernel.org" , "neilb@suse.de" , "okorniev@redhat.com" , "Dai.Ngo@oracle.com" , "tom@talpey.com" , "linux-nfs@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "yukuai1@huaweicloud.com" , "houtao1@huawei.com" , "yi.zhang@huawei.com" , "yangerkun@huawei.com" , "lilingfeng@huaweicloud.com" Subject: RE: [PATCH] nfsd: return -EINVAL when namelen is 0 Thread-Topic: [PATCH] nfsd: return -EINVAL when namelen is 0 Thread-Index: AQHa/tltH5fpypZKDEqICq9omYVD5rJOXHzAgADqoYCAABJ2gA== Date: Mon, 9 Sep 2024 11:33:04 +0000 Message-ID: <674f0d570dc241bf86294a9c8141a0b4@AcuMS.aculab.com> References: <20240903111446.659884-1-lilingfeng3@huawei.com> In-Reply-To: Accept-Language: en-GB, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: aculab.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable From: Scott Mayhew > Sent: 09 September 2024 12:24 ... > > > > diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c > > > > index 67d8673a9391..69a3a84e159e 100644 > > > > --- a/fs/nfsd/nfs4recover.c > > > > +++ b/fs/nfsd/nfs4recover.c > > > > @@ -809,6 +809,10 @@ __cld_pipe_inprogress_downcall(const struct cl= d_msg_v2 __user *cmsg, > > > > =09=09=09ci =3D &cmsg->cm_u.cm_clntinfo; > > > > =09=09=09if (get_user(namelen, &ci->cc_name.cn_len)) > > > > =09=09=09=09return -EFAULT; > > > > +=09=09=09if (!namelen) { > > > > +=09=09=09=09dprintk("%s: namelen should not be zero", __func__); > > > > +=09=09=09=09return -EINVAL; > > > > +=09=09=09} > > > > =09=09=09name.data =3D memdup_user(&ci->cc_name.cn_id, namelen); > > > > Don't you also want an upper bound sanity check? > > (or is cn_len only 8 bit?) >=20 > Yeah, actually it should probably be checking for namelen > > NFS4_OPAQUE_LIMIT. I suspect memdup_user() itself should have a third 'maxlen' argument. And probably one that is required to be a compile-time constant. Oh, and is dprintk() rate-limited? Not that the message looks very helpful. =09David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1= PT, UK Registration No: 1397386 (Wales)