Commit 94545ffc authored by Jenny Guanni Qu's avatar Jenny Guanni Qu Committed by Trond Myklebust
Browse files

pnfs/flexfiles: validate ds_versions_cnt is non-zero 



nfs4_ff_alloc_deviceid_node() reads version_count from XDR without
checking it is non-zero. When a malicious NFS server sends a pNFS
LAYOUTGET response with version_count=0, kcalloc(0, ...) returns
ZERO_SIZE_PTR (0x10). The subsequent ds_versions[0] access in
nfs4_ff_layout_ds_version() and other callers dereferences this
invalid pointer, causing an out-of-bounds read.

Add a check for version_count == 0 after parsing it from XDR, before
the allocation.

The OOB read was confirmed with KASAN: null-ptr-deref in range
[0x0000000000000010-0x0000000000000017] from accessing ZERO_SIZE_PTR.

Fixes: d67ae825 ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Reported-by: default avatarKlaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: default avatarDawid Moczadło <dawid@vidocsecurity.com>
Tested-by: default avatarJenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: default avatarJenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent b0ed1253

fs/nfs/flexfilelayout/flexfilelayoutdev.c

+5 −0
Original line number Diff line number Diff line
@@ -97,6 +97,11 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev, 
	if (unlikely(!p))

		goto out_err_drain_dsaddrs;

	version_count = be32_to_cpup(p);



	if (version_count == 0) {

		ret = -EINVAL;

		goto out_err_drain_dsaddrs;

	}

	dprintk("%s: version count %d\n", __func__, version_count);



	ds_versions = kzalloc_objs(struct nfs4_ff_ds_version, version_count,