]> git.baikalelectronics.ru Git - kernel.git/commit
lockd: detect and reject lock arguments that overflow
authorJeff Layton <jlayton@kernel.org>
Mon, 1 Aug 2022 19:57:26 +0000 (15:57 -0400)
committerChuck Lever <chuck.lever@oracle.com>
Thu, 4 Aug 2022 14:28:48 +0000 (10:28 -0400)
commit2523f09a3413ff12a8f419b5a1f96257690c5afd
tree82234eae589392283b24717de9ac2eac1845cb22
parente10a8d36d6fdb5db67de3b6b5ea3993fb83d7a4e
lockd: detect and reject lock arguments that overflow

lockd doesn't currently vet the start and length in nlm4 requests like
it should, and can end up generating lock requests with arguments that
overflow when passed to the filesystem.

The NLM4 protocol uses unsigned 64-bit arguments for both start and
length, whereas struct file_lock tracks the start and end as loff_t
values. By the time we get around to calling nlm4svc_retrieve_args,
we've lost the information that would allow us to determine if there was
an overflow.

Start tracking the actual start and len for NLM4 requests in the
nlm_lock. In nlm4svc_retrieve_args, vet these values to ensure they
won't cause an overflow, and return NLM4_FBIG if they do.

Link: https://bugzilla.linux-nfs.org/show_bug.cgi?id=392
Reported-by: Jan Kasiak <j.kasiak@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org> # 5.14+
fs/lockd/svc4proc.c
fs/lockd/xdr4.c
include/linux/lockd/xdr.h