From owner-svn-src-all@freebsd.org Sat Jan 27 16:03:48 2018 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A87F1EC8D5D; Sat, 27 Jan 2018 16:03:48 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 2B7146E1AF; Sat, 27 Jan 2018 16:03:48 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from tom.home (kib@localhost [127.0.0.1]) by kib.kiev.ua (8.15.2/8.15.2) with ESMTPS id w0RG3exF069554 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 27 Jan 2018 18:03:43 +0200 (EET) (envelope-from kostikbel@gmail.com) DKIM-Filter: OpenDKIM Filter v2.10.3 kib.kiev.ua w0RG3exF069554 Received: (from kostik@localhost) by tom.home (8.15.2/8.15.2/Submit) id w0RG3e6q069553; Sat, 27 Jan 2018 18:03:40 +0200 (EET) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com using -f Date: Sat, 27 Jan 2018 18:03:40 +0200 From: Konstantin Belousov To: "Pedro F. Giffuni" Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r328479 - in head/sys: fs/ext2fs ufs/ufs Message-ID: <20180127160340.GB55707@kib.kiev.ua> References: <201801271533.w0RFXq0K057921@repo.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201801271533.w0RFXq0K057921@repo.freebsd.org> User-Agent: Mutt/1.9.2 (2017-12-15) X-Spam-Status: No, score=-2.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED autolearn=no autolearn_force=no version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on tom.home X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jan 2018 16:03:48 -0000 On Sat, Jan 27, 2018 at 03:33:52PM +0000, Pedro F. Giffuni wrote: > Author: pfg > Date: Sat Jan 27 15:33:52 2018 > New Revision: 328479 > URL: https://svnweb.freebsd.org/changeset/base/328479 > > Log: > {ext2|ufs}_readdir: Set limit on valid ncookies values. > > Sanitize the values that will be assigned to ncookies so that we ensure > they are sane and we can handle them. > > Let ncookies signed as it was before r328346. The valid range is such > that unsigned values are not required and we are not able to avoid at > least one cast anyways. > > Hinted by: bde > > Modified: > head/sys/fs/ext2fs/ext2_lookup.c > head/sys/ufs/ufs/ufs_vnops.c > > Modified: head/sys/fs/ext2fs/ext2_lookup.c > ============================================================================== > --- head/sys/fs/ext2fs/ext2_lookup.c Sat Jan 27 13:46:55 2018 (r328478) > +++ head/sys/fs/ext2fs/ext2_lookup.c Sat Jan 27 15:33:52 2018 (r328479) > @@ -145,14 +145,18 @@ ext2_readdir(struct vop_readdir_args *ap) > off_t offset, startoffset; > size_t readcnt, skipcnt; > ssize_t startresid; > - u_int ncookies; > + int ncookies; > int DIRBLKSIZ = VTOI(ap->a_vp)->i_e2fs->e2fs_bsize; > int error; > > if (uio->uio_offset < 0) > return (EINVAL); > ip = VTOI(vp); > + if (uio->uio_resid < 0) > + uio->uio_resid = 0; > if (ap->a_ncookies != NULL) { > + if (uio->uio_resid > MAXPHYS) > + uio->uio_resid = MAXPHYS; > ncookies = uio->uio_resid; > if (uio->uio_offset >= ip->i_size) > ncookies = 0; > > Modified: head/sys/ufs/ufs/ufs_vnops.c > ============================================================================== > --- head/sys/ufs/ufs/ufs_vnops.c Sat Jan 27 13:46:55 2018 (r328478) > +++ head/sys/ufs/ufs/ufs_vnops.c Sat Jan 27 15:33:52 2018 (r328479) > @@ -2170,7 +2170,7 @@ ufs_readdir(ap) > off_t offset, startoffset; > size_t readcnt, skipcnt; > ssize_t startresid; > - u_int ncookies; > + int ncookies; > int error; > > if (uio->uio_offset < 0) > @@ -2178,7 +2178,11 @@ ufs_readdir(ap) > ip = VTOI(vp); > if (ip->i_effnlink == 0) > return (0); > + if (uio->uio_resid < 0) > + uio->uio_resid = 0; > if (ap->a_ncookies != NULL) { > + if (uio->uio_resid > MAXPHYS) > + uio->uio_resid = MAXPHYS; You just break nfs server. Look at nfsrvd_readdir() call to VOP_READDIR. Almost all code which calls VOP_READDIR() memoize the value of uio_resid before and after the call and interpret the difference as the amount of data returned. I said above that only nfs server is broken, because only the server uses cookies, otherwise your patch would break everything. > ncookies = uio->uio_resid; > if (uio->uio_offset >= ip->i_size) > ncookies = 0;