CVE-2011-4131 (C, published 2012-05-17T11:00Z)
Description: value: The NFSv4 implementation in the Linux kernel before 3.2.2 does not properly handle bitmap sizes in GETACL replies, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/torvalds/linux
Files changed:
fs/nfs/nfs4proc.c
fs/nfs/nfs4xdr.c
include/linux/nfs_xdr.h
include/linux/sunrpc/xdr.h
net/sunrpc/xdr.c
Commit message: NFSv4: include bitmap in nfsv4 get acl data

The NFSv4 bitmap size is unbounded: a server can return an arbitrary
sized bitmap in an FATTR4_WORD0_ACL request.  Replace using the
nfs4_fattr_bitmap_maxsz as a guess to the maximum bitmask returned by a server
with the inclusion of the bitmap (xdr length plus bitmasks) and the acl data
xdr length to the (cached) acl page data.

This is a general solution to commit e5012d1f "NFSv4.1: update
nfs4_fattr_bitmap_maxsz" and fixes hitting a BUG_ON in xdr_shrink_bufhead
when getting ACLs.

Fix a bug in decode_getacl that returned -EINVAL on ACLs > page when getxattr
was called with a NULL buffer, preventing ACL > PAGE_SIZE from being retrieved.

Cc: stable@kernel.org
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>


Vulnerable code:
static void buf_to_pages(const void *buf, size_t buflen,
		struct page **pages, unsigned int *pgbase)
{
	const void *p = buf;

	*pgbase = offset_in_page(buf);
	p -= *pgbase;
	while (p < buf + buflen) {
		*(pages++) = virt_to_page(p);
		p += PAGE_CACHE_SIZE;
	}
}

	struct page *pages[NFS4ACL_MAXPAGES];
	struct page *localpage = NULL;
	int ret;
	if (buflen < PAGE_SIZE) {
		/* As long as we're doing a round trip to the server anyway,
		 * let's be prepared for a page of acl data. */
		localpage = alloc_page(GFP_KERNEL);
		resp_buf = page_address(localpage);
		if (localpage == NULL)
			return -ENOMEM;
		args.acl_pages[0] = localpage;
		args.acl_pgbase = 0;
		args.acl_len = PAGE_SIZE;
	} else {
		resp_buf = buf;
		buf_to_pages(buf, buflen, args.acl_pages, &args.acl_pgbase);
	ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode), &msg, &args.seq_args, &res.seq_res, 0);
	if (res.acl_len > args.acl_len)
		nfs4_write_cached_acl(inode, NULL, res.acl_len);
		nfs4_write_cached_acl(inode, resp_buf, res.acl_len);
		if (res.acl_len > buflen)
		if (localpage)
			memcpy(buf, resp_buf, res.acl_len);
	ret = res.acl_len;
	if (localpage)
		__free_page(localpage);
	replen = hdr.replen + op_decode_hdr_maxsz + nfs4_fattr_bitmap_maxsz + 1;
		size_t *acl_len)
	__be32 *savep;
	*acl_len = 0;
			dprintk("NFS: server cheating in getattr"
					" acl reply: attrlen %u > recvd %u\n",
		*acl_len = attrlen;
	status = decode_getacl(xdr, rqstp, &res->acl_len);
static void

Fixed code:
/*
 * The getxattr API returns the required buffer length when called with a
 * NULL buf. The NFSv4 acl tool then calls getxattr again after allocating
 * the required buf.  On a NULL buf, we send a page of data to the server
 * guessing that the ACL request can be serviced by a page. If so, we cache
 * up to the page of ACL data, and the 2nd call to getxattr is serviced by
 * the cache. If not so, we throw away the page, and cache the required
 * length. The next getxattr call will then produce another round trip to
 * the server, this time with the input buf of the required size.
 */
	struct page *pages[NFS4ACL_MAXPAGES] = {NULL, };
	int ret = -ENOMEM, npages, i, acl_len = 0;
	npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
	/* As long as we're doing a round trip to the server anyway,
	 * let's be prepared for a page of acl data. */
	if (npages == 0)
		npages = 1;

	for (i = 0; i < npages; i++) {
		pages[i] = alloc_page(GFP_KERNEL);
		if (!pages[i])
			goto out_free;
	}
	if (npages > 1) {
		/* for decoding across pages */
		args.acl_scratch = alloc_page(GFP_KERNEL);
		if (!args.acl_scratch)
			goto out_free;
	args.acl_len = npages * PAGE_SIZE;
	args.acl_pgbase = 0;
	/* Let decode_getfacl know not to fail if the ACL data is larger than
	 * the page we send as a guess */
	if (buf == NULL)
		res.acl_flags |= NFS4_ACL_LEN_REQUEST;
	resp_buf = page_address(pages[0]);

	dprintk("%s  buf %p buflen %ld npages %d args.acl_len %ld\n",
		__func__, buf, buflen, npages, args.acl_len);
	ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode),
			     &msg, &args.seq_args, &res.seq_res, 0);

	acl_len = res.acl_len - res.acl_data_offset;
	if (acl_len > args.acl_len)
		nfs4_write_cached_acl(inode, NULL, acl_len);
		nfs4_write_cached_acl(inode, resp_buf + res.acl_data_offset,
				      acl_len);
		if (acl_len > buflen)
		_copy_from_pages(buf, pages, res.acl_data_offset,
				res.acl_len);
	ret = acl_len;
	for (i = 0; i < npages; i++)
		if (pages[i])
			__free_page(pages[i]);
	if (args.acl_scratch)
		__free_page(args.acl_scratch);
		/* -ENOENT is returned if there is no ACL or if there is an ACL
		 * but no cached acl data, just the acl length */
	replen = hdr.replen + op_decode_hdr_maxsz + 1;
	xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);

			 struct nfs_getaclres *res)
	__be32 *savep, *bm_p;
	res->acl_len = 0;
	bm_p = xdr->p;
		/* The bitmap (xdr len + bitmaps) and the attr xdr len words
		 * are stored with the acl data to handle the problem of
		 * variable length bitmaps.*/
		xdr->p = bm_p;
		res->acl_data_offset = be32_to_cpup(bm_p) + 2;
		res->acl_data_offset <<= 2;

		attrlen += res->acl_data_offset;
			if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
				/* getxattr interface called with a NULL buf */
				res->acl_len = attrlen;
				goto out;
			}
			dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
		res->acl_len = attrlen;
	status = decode_getacl(xdr, rqstp, res);
	struct page *			acl_scratch;
/* getxattr ACL interface flags */
#define NFS4_ACL_LEN_REQUEST	0x0001	/* zero length getxattr buffer */
	size_t				acl_data_offset;
	int				acl_flags;
extern void _copy_from_pages(char *p, struct page **pages, size_t pgbase,
			     size_t len);
void
EXPORT_SYMBOL_GPL(_copy_from_pages);