[PATCH] nfsd4: do not compute undefined pointer arithmetic

[Jason A. Donenfeld]

From: "Jason A. Donenfeld" <Jason@xxxxxxxxx>

If statp is NULL, "NULL - ptr_value" will be computed, which is
undefined behavior:

    When two pointers are subtracted, both shall point to elements of
    the same array object, or one past the last element of the array
    object; the result is the difference of the subscripts of the two
    array elements. -6.5.6.9

This causes issues with the PaX size overflow gcc plugin, and may cause
problems in other compiler instrumentation and other issues down the
line.

The PaX error message is as follows:

    PAX: size overflow detected in function nfsd_cache_update fs/nfsd/nfscache.c:267 cicus.155_59 min, count: 26
    Pid: 10581, comm: nfsd Not tainted 3.8.6-grsec #4
    Call Trace:
     [<ffffffff8114fbd0>] ? report_size_overflow+0x20/0x30
     [<ffffffff81241e52>] ? nfsd_cache_update+0x232/0x270
     [<ffffffff81238062>] ? nfsd_dispatch+0x112/0x190
     [<ffffffff81616320>] ? svc_process_common+0x410/0x5c0
     [<ffffffff81617302>] ? svc_process+0x102/0x160
     [<ffffffff81237a4f>] ? nfsd+0xaf/0x120
     [<ffffffff812379a0>] ? nfsd_destroy+0x70/0x70
     [<ffffffff810ad03f>] ? kthread+0xaf/0xc0
     [<ffffffff810acf90>] ? __kthread_bind+0x30/0x30
     [<ffffffff8164c2f2>] ? ret_from_fork+0x72/0xa0
     [<ffffffff810acf90>] ? __kthread_bind+0x30/0x30

Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx>
---
 fs/nfsd/nfscache.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index ca05f6d..466d108 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -466,8 +466,11 @@ nfsd_cache_update(struct svc_rqst *rqstp, int cachetype, __be32 *statp)
 	if (!rp)
 		return;
 
-	len = resv->iov_len - ((char*)statp - (char*)resv->iov_base);
-	len >>= 2;
+	/* Do not calculate NULL - ptr_value, as it overflows. */
+	if (statp) {
+		len = resv->iov_len - ((char*)statp - (char*)resv->iov_base);
+		len >>= 2;
+	}
 
 	/* Don't cache excessive amounts of data and XDR failures */
 	if (!statp || len > (256 >> 2)) {
-- 
1.8.1.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/