This is a note to let you know that I've just added the patch titled
libceph: fix overflow in __decode_pool_names()
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
0056-libceph-fix-overflow-in-__decode_pool_names.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From d87d591772b2956b9ac9e25eb499366100d2c4a8 Mon Sep 17 00:00:00 2001
From: Xi Wang <[email protected]>
Date: Wed, 6 Jun 2012 19:35:55 -0500
Subject: libceph: fix overflow in __decode_pool_names()
From: Xi Wang <[email protected]>
(cherry picked from commit ad3b904c07dfa88603689bf9a67bffbb9b99beb5)
`len' is read from network and thus needs validation. Otherwise a
large `len' would cause out-of-bounds access via the memcpy() call.
In addition, len = 0xffffffff would overflow the kmalloc() size,
leading to out-of-bounds write.
This patch adds a check of `len' via ceph_decode_need(). Also use
kstrndup rather than kmalloc/memcpy.
[[email protected]: added -ENOMEM return for null kstrndup() result]
Signed-off-by: Xi Wang <[email protected]>
Reviewed-by: Alex Elder <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/ceph/osdmap.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -495,15 +495,16 @@ static int __decode_pool_names(void **p,
ceph_decode_32_safe(p, end, pool, bad);
ceph_decode_32_safe(p, end, len, bad);
dout(" pool %d len %d\n", pool, len);
+ ceph_decode_need(p, end, len, bad);
pi = __lookup_pg_pool(&map->pg_pools, pool);
if (pi) {
+ char *name = kstrndup(*p, len, GFP_NOFS);
+
+ if (!name)
+ return -ENOMEM;
kfree(pi->name);
- pi->name = kmalloc(len + 1, GFP_NOFS);
- if (pi->name) {
- memcpy(pi->name, *p, len);
- pi->name[len] = '\0';
- dout(" name is %s\n", pi->name);
- }
+ pi->name = name;
+ dout(" name is %s\n", pi->name);
}
*p += len;
}
Patches currently in stable-queue which might be from [email protected] are
queue-3.4/ipv4-avoid-undefined-behavior-in-do_ip_setsockopt.patch
queue-3.4/0058-libceph-fix-overflow-in-osdmap_apply_incremental.patch
queue-3.4/0057-libceph-fix-overflow-in-osdmap_decode.patch
queue-3.4/0056-libceph-fix-overflow-in-__decode_pool_names.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
