git: 96f65d85d431 - stable/13 - nfsd: Fix sanity check for NFSv4.2 Allocate operations

[Rick Macklem]

The branch stable/13 has been updated by rmacklem:

URL: https://cgit.FreeBSD.org/src/commit/?id=96f65d85d43167e3e65738c2b93414dea071015a

commit 96f65d85d43167e3e65738c2b93414dea071015a
Author:     Rick Macklem <rmacklem at FreeBSD.org>
AuthorDate: 2021-08-12 23:48:28 +0000
Commit:     Rick Macklem <rmacklem at FreeBSD.org>
CommitDate: 2021-08-27 01:05:28 +0000

    nfsd: Fix sanity check for NFSv4.2 Allocate operations
    
    The NFSv4.2 Allocate operation sanity checks the aa_offset
    and aa_length arguments.  Since they are assigned to variables
    of type off_t (signed) it was possible for them to be negative.
    It was also possible for aa_offset+aa_length to exceed OFF_MAX
    when stored in lo_end, which is uint64_t.
    
    This patch adds checks for these cases to the sanity check.
    
    (cherry picked from commit 06afb53bcd7b6a928bc90acb820383302ea8be9e)
---
 sys/fs/nfsserver/nfs_nfsdserv.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c
index 0ba3472b4ff9..12181d04f1fa 100644
--- a/sys/fs/nfsserver/nfs_nfsdserv.c
+++ b/sys/fs/nfsserver/nfs_nfsdserv.c
@@ -5347,12 +5347,18 @@ nfsrvd_allocate(struct nfsrv_descript *nd, __unused int isdgram,
 	off = fxdr_hyper(tl); tl += 2;
 	lop->lo_first = off;
 	len = fxdr_hyper(tl);
-	lop->lo_end = off + len;
+	lop->lo_end = lop->lo_first + len;
 	/*
-	 * Paranoia, just in case it wraps around, which shouldn't
-	 * ever happen anyhow.
+	 * Sanity check the offset and length.
+	 * off and len are off_t (signed int64_t) whereas
+	 * lo_first and lo_end are uint64_t and, as such,
+	 * if off >= 0 && len > 0, lo_end cannot overflow
+	 * unless off_t is changed to something other than
+	 * int64_t.  Check lo_end < lo_first in case that
+	 * is someday the case.
 	 */
-	if (nd->nd_repstat == 0 && (lop->lo_end < lop->lo_first || len <= 0))
+	if (nd->nd_repstat == 0 && (len <= 0 || off < 0 || lop->lo_end >
+	    OFF_MAX || lop->lo_end < lop->lo_first))
 		nd->nd_repstat = NFSERR_INVAL;
 
 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)