Unified · Split
| @@ -200,7 +200,7 @@ static int process_one_ticket(struct ceph_auth_client *ac, · 199 unmodified lines | ||
| 200 | 200 | dout(" decrypted %d bytes\n", ret); |
| 201 | 201 | dend = dp + ret; |
| 202 | 202 | |
| 203 | − tkt_struct_v = ceph_decode_8(&dp); | |
| 203 | + ceph_decode_8_safe(&dp, dend, tkt_struct_v, bad); | |
| 204 | 204 | if (tkt_struct_v != 1) |
| 205 | 205 | goto bad; |
| 206 | 206 | |
| @@ -208,6 +208,7 @@ static int process_one_ticket(struct ceph_auth_client *ac, · 1 unmodified line | ||
| 208 | 208 | if (ret) |
| 209 | 209 | goto out; |
| 210 | 210 | |
| 211 | + ceph_decode_need(&dp, dend, sizeof(struct ceph_timespec), bad); | |
| 211 | 212 | ceph_decode_timespec64(&validity, dp); |
| 212 | 213 | dp += sizeof(struct ceph_timespec); |
| 213 | 214 | new_expires = ktime_get_real_seconds() + validity.tv_sec; |
| @@ -491,6 +492,7 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, · 277 unmodified lines | ||
| 491 | 492 | struct ceph_x_info *xi = ac->private; |
| 492 | 493 | int need; |
| 493 | 494 | struct ceph_x_request_header *head = buf; |
| 495 | + void *p; | |
| 494 | 496 | int ret; |
| 495 | 497 | struct ceph_x_ticket_handler *th = |
| 496 | 498 | get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); |
| @@ -504,12 +506,12 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, · 7 unmodified lines | ||
| 504 | 506 | |
| 505 | 507 | if (need & CEPH_ENTITY_TYPE_AUTH) { |
| 506 | 508 | struct ceph_x_authenticate *auth = (void *)(head + 1); |
| 507 | − void *p = auth + 1; | |
| 508 | 509 | void *enc_buf = xi->auth_authorizer.enc_buf; |
| 509 | 510 | struct ceph_x_challenge_blob *blob = enc_buf + |
| 510 | 511 | ceph_x_encrypt_offset(); |
| 511 | 512 | u64 *u; |
| 512 | 513 | |
| 514 | + p = auth + 1; | |
| 513 | 515 | if (p > end) |
| 514 | 516 | return -ERANGE; |
| 515 | 517 | |
| @@ -542,35 +544,35 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, · 26 unmodified lines | ||
| 542 | 544 | } |
| 543 | 545 | |
| 544 | 546 | if (need) { |
| 545 | − void *p = head + 1; | |
| 546 | − struct ceph_x_service_ticket_request *req; | |
| 547 | − | |
| 548 | − if (p > end) | |
| 549 | − return -ERANGE; | |
| 550 | − head->op = cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY); | |
| 551 | − | |
| 547 | + dout(" get_principal_session_key\n"); | |
| 552 | 548 | ret = ceph_x_build_authorizer(ac, th, &xi->auth_authorizer); |
| 553 | 549 | if (ret) |
| 554 | 550 | return ret; |
| 555 | − ceph_encode_copy(&p, xi->auth_authorizer.buf->vec.iov_base, | |
| 556 | − xi->auth_authorizer.buf->vec.iov_len); | |
| 557 | 551 | |
| 558 | − req = p; | |
| 559 | − req->keys = cpu_to_le32(need); | |
| 560 | − p += sizeof(*req); | |
| 552 | + p = buf; | |
| 553 | + ceph_encode_16_safe(&p, end, CEPHX_GET_PRINCIPAL_SESSION_KEY, | |
| 554 | + e_range); | |
| 555 | + ceph_encode_copy_safe(&p, end, | |
| 556 | + xi->auth_authorizer.buf->vec.iov_base, | |
| 557 | + xi->auth_authorizer.buf->vec.iov_len, e_range); | |
| 558 | + ceph_encode_8_safe(&p, end, 1, e_range); | |
| 559 | + ceph_encode_32_safe(&p, end, need, e_range); | |
| 561 | 560 | return p - buf; |
| 562 | 561 | } |
| 563 | 562 | |
| 564 | 563 | return 0; |
| 564 | + | |
| 565 | +e_range: | |
| 566 | + return -ERANGE; | |
| 565 | 567 | } |
| 566 | 568 | |
| 567 | 569 | static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, |
| 568 | 570 | void *buf, void *end) |
| 569 | 571 | { |
| 570 | 572 | struct ceph_x_info *xi = ac->private; |
| 571 | − struct ceph_x_reply_header *head = buf; | |
| 572 | 573 | struct ceph_x_ticket_handler *th; |
| 573 | 574 | int len = end - buf; |
| 575 | + void *p; | |
| 574 | 576 | int op; |
| 575 | 577 | int ret; |
| 576 | 578 | |
| @@ -591,22 +593,22 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, · 14 unmodified lines | ||
| 591 | 593 | return -EAGAIN; |
| 592 | 594 | } |
| 593 | 595 | |
| 594 | − op = le16_to_cpu(head->op); | |
| 595 | − result = le32_to_cpu(head->result); | |
| 596 | + p = buf; | |
| 597 | + ceph_decode_16_safe(&p, end, op, e_inval); | |
| 598 | + ceph_decode_32_safe(&p, end, result, e_inval); | |
| 596 | 599 | dout("handle_reply op %d result %d\n", op, result); |
| 597 | 600 | switch (op) { |
| 598 | 601 | case CEPHX_GET_AUTH_SESSION_KEY: |
| 599 | 602 | /* verify auth key */ |
| 600 | − ret = ceph_x_proc_ticket_reply(ac, &xi->secret, | |
| 601 | − buf + sizeof(*head), end); | |
| 603 | + ret = ceph_x_proc_ticket_reply(ac, &xi->secret, p, end); | |
| 602 | 604 | break; |
| 603 | 605 | |
| 604 | 606 | case CEPHX_GET_PRINCIPAL_SESSION_KEY: |
| 605 | 607 | th = get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); |
| 606 | 608 | if (IS_ERR(th)) |
| 607 | 609 | return PTR_ERR(th); |
| 608 | − ret = ceph_x_proc_ticket_reply(ac, &th->session_key, | |
| 609 | − buf + sizeof(*head), end); | |
| 610 | + | |
| 611 | + ret = ceph_x_proc_ticket_reply(ac, &th->session_key, p, end); | |
| 610 | 612 | break; |
| 611 | 613 | |
| 612 | 614 | default: |
| @@ -617,6 +619,9 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, · 4 unmodified lines | ||
| 617 | 619 | if (ac->want_keys == xi->have_keys) |
| 618 | 620 | return 0; |
| 619 | 621 | return -EAGAIN; |
| 622 | + | |
| 623 | +e_inval: | |
| 624 | + return -EINVAL; | |
| 620 | 625 | } |
| 621 | 626 | |
| 622 | 627 | static void ceph_x_destroy_authorizer(struct ceph_authorizer *a) |