releases/4.14.53/nfsv4-fix-possible-1-byte-stack-overflow-in-nfs_idmap_read_and_verify_message.patch

   1 From d68894800ec5712d7ddf042356f11e36f87d7f78 Mon Sep 17 00:00:00 2001
   2 From: Dave Wysochanski <dwysocha@redhat.com>
   3 Date: Tue, 29 May 2018 17:47:30 -0400
   4 Subject: NFSv4: Fix possible 1-byte stack overflow in nfs_idmap_read_and_verify_message
   5
   6 From: Dave Wysochanski <dwysocha@redhat.com>
   7
   8 commit d68894800ec5712d7ddf042356f11e36f87d7f78 upstream.
   9
  10 In nfs_idmap_read_and_verify_message there is an incorrect sprintf '%d'
  11 that converts the __u32 'im_id' from struct idmap_msg to 'id_str', which
  12 is a stack char array variable of length NFS_UINT_MAXLEN == 11.
  13 If a uid or gid value is > 2147483647 = 0x7fffffff, the conversion
  14 overflows into a negative value, for example:
  15 crash> p (unsigned) (0x80000000)
  16 $1 = 2147483648
  17 crash> p (signed) (0x80000000)
  18 $2 = -2147483648
  19 The '-' sign is written to the buffer and this causes a 1 byte overflow
  20 when the NULL byte is written, which corrupts kernel stack memory.  If
  21 CONFIG_CC_STACKPROTECTOR_STRONG is set we see a stack-protector panic:
  22
  23 [11558053.616565] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa05b8a8c
  24 [11558053.639063] CPU: 6 PID: 9423 Comm: rpc.idmapd Tainted: G        W      ------------ T 3.10.0-514.el7.x86_64 #1
  25 [11558053.641990] Hardware name: Red Hat OpenStack Compute, BIOS 1.10.2-3.el7_4.1 04/01/2014
  26 [11558053.644462]  ffffffff818c7bc0 00000000b1f3aec1 ffff880de0f9bd48 ffffffff81685eac
  27 [11558053.646430]  ffff880de0f9bdc8 ffffffff8167f2b3 ffffffff00000010 ffff880de0f9bdd8
  28 [11558053.648313]  ffff880de0f9bd78 00000000b1f3aec1 ffffffff811dcb03 ffffffffa05b8a8c
  29 [11558053.650107] Call Trace:
  30 [11558053.651347]  [<ffffffff81685eac>] dump_stack+0x19/0x1b
  31 [11558053.653013]  [<ffffffff8167f2b3>] panic+0xe3/0x1f2
  32 [11558053.666240]  [<ffffffff811dcb03>] ? kfree+0x103/0x140
  33 [11558053.682589]  [<ffffffffa05b8a8c>] ? idmap_pipe_downcall+0x1cc/0x1e0 [nfsv4]
  34 [11558053.689710]  [<ffffffff810855db>] __stack_chk_fail+0x1b/0x30
  35 [11558053.691619]  [<ffffffffa05b8a8c>] idmap_pipe_downcall+0x1cc/0x1e0 [nfsv4]
  36 [11558053.693867]  [<ffffffffa00209d6>] rpc_pipe_write+0x56/0x70 [sunrpc]
  37 [11558053.695763]  [<ffffffff811fe12d>] vfs_write+0xbd/0x1e0
  38 [11558053.702236]  [<ffffffff810acccc>] ? task_work_run+0xac/0xe0
  39 [11558053.704215]  [<ffffffff811fec4f>] SyS_write+0x7f/0xe0
  40 [11558053.709674]  [<ffffffff816964c9>] system_call_fastpath+0x16/0x1b
  41
  42 Fix this by calling the internally defined nfs_map_numeric_to_string()
  43 function which properly uses '%u' to convert this __u32.  For consistency,
  44 also replace the one other place where snprintf is called.
  45
  46 Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
  47 Reported-by: Stephen Johnston <sjohnsto@redhat.com>
  48 Fixes: cf4ab538f1516 ("NFSv4: Fix the string length returned by the idmapper")
  49 Cc: stable@vger.kernel.org # v3.4+
  50 Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
  51 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  52
  53 ---
  54  fs/nfs/nfs4idmap.c |    5 +++--
  55  1 file changed, 3 insertions(+), 2 deletions(-)
  56
  57 --- a/fs/nfs/nfs4idmap.c
  58 +++ b/fs/nfs/nfs4idmap.c
  59 @@ -343,7 +343,7 @@ static ssize_t nfs_idmap_lookup_name(__u
  60         int id_len;
  61         ssize_t ret;
  62
  63 -       id_len = snprintf(id_str, sizeof(id_str), "%u", id);
  64 +       id_len = nfs_map_numeric_to_string(id, id_str, sizeof(id_str));
  65         ret = nfs_idmap_get_key(id_str, id_len, type, buf, buflen, idmap);
  66         if (ret < 0)
  67                 return -EINVAL;
  68 @@ -627,7 +627,8 @@ static int nfs_idmap_read_and_verify_mes
  69                 if (strcmp(upcall->im_name, im->im_name) != 0)
  70                         break;
  71                 /* Note: here we store the NUL terminator too */
  72 -               len = sprintf(id_str, "%d", im->im_id) + 1;
  73 +               len = 1 + nfs_map_numeric_to_string(im->im_id, id_str,
  74 +                                                   sizeof(id_str));
  75                 ret = nfs_idmap_instantiate(key, authkey, id_str, len);
  76                 break;
  77         case IDMAP_CONV_IDTONAME: