rquota overflow fix never applied ?

rquota overflow fix never applied ?

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 222 bytes --]

Gentoo and Fedora both apply an old patch to resolve an overflow issue ... is 
this just a case of fixes never going upstream or is there a reason this 
hasnt been applied ... if so, can someone please clue me in ;)
-mike

[-- Attachment #2: nfs-utils-0.3.3-rquotad-overflow.patch --]
[-- Type: text/x-diff, Size: 1243 bytes --]

--- nfs-utils-0.3.3/utils/rquotad/rquota_server.c.orig	Wed Jun 27 12:45:56 2001
+++ nfs-utils-0.3.3/utils/rquotad/rquota_server.c	Thu Nov 11 14:36:39 2004
@@ -76,6 +76,7 @@ getquota_rslt *getquotainfo(int flags, c
    char *pathname, *qfpathname;
    int fd, err, id, type;
    struct stat stm, stn;
+   struct rquota *rquota;
 
    /*
     * First check authentication.
@@ -168,8 +169,16 @@ getquota_rslt *getquotainfo(int flags, c
           * Make a copy of the info into the last part of the remote quota
           * struct which is exactly the same.
           */
-         memcpy((caddr_t *)&result.getquota_rslt_u.gqr_rquota.rq_bhardlimit,
-                (caddr_t *)&dq_dqb, sizeof(struct dqblk));
+
+         rquota = &result.getquota_rslt_u.gqr_rquota;
+         rquota->rq_bhardlimit = dq_dqb.dqb_bhardlimit;
+         rquota->rq_bsoftlimit = dq_dqb.dqb_bsoftlimit;;
+         rquota->rq_curblocks = dq_dqb.dqb_curblocks;
+         rquota->rq_fhardlimit = dq_dqb.dqb_ihardlimit;
+         rquota->rq_fsoftlimit = dq_dqb.dqb_isoftlimit;
+         rquota->rq_curfiles = dq_dqb.dqb_curinodes;
+         rquota->rq_btimeleft = dq_dqb.dqb_btime;
+         rquota->rq_ftimeleft = dq_dqb.dqb_itime;
 
          return(&result);
       }

Re: rquota overflow fix never applied ?

[Neil Brown]

On Tuesday August 30, vapier@gentoo.org wrote:
> Gentoo and Fedora both apply an old patch to resolve an overflow issue ... is 
> this just a case of fixes never going upstream or is there a reason this 
> hasnt been applied ... if so, can someone please clue me in ;)
> -mike

Well..... the patch does seem to be somewhat flawed .....
There is a comment, and matching code, and the code is changed, but
not the comment !!! :-)

However I don't think that would be the reason.  I think it either has
not been sent upstream, it when it was it was missed and not resent.

I have added it to my tree, with appropriate changes to the comment.

However I seem to be a bit thick today and cannot see where the
overflow is happening.
dqblk is 6 u_int32_t's and 2 time_t's
struct rquota (after rq_bhardlimit) is 8 u_int's

On what arch are there different?
(maybe time_t isn't 32bits everwhere, is that it?)

NeilBrown

> @@ -168,8 +169,16 @@ getquota_rslt *getquotainfo(int flags, c
>            * Make a copy of the info into the last part of the remote quota
>            * struct which is exactly the same.
>            */


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: rquota overflow fix never applied ?

[Mike Frysinger]

On Tuesday 30 August 2005 02:09 am, Neil Brown wrote:
> On Tuesday August 30, vapier@gentoo.org wrote:
> > Gentoo and Fedora both apply an old patch to resolve an overflow issue
> > ... is this just a case of fixes never going upstream or is there a
> > reason this hasnt been applied ... if so, can someone please clue me in
> > ;)
>
> Well..... the patch does seem to be somewhat flawed .....
> There is a comment, and matching code, and the code is changed, but
> not the comment !!! :-)

i'm just the messenger, i didnt write it ;)

> However I don't think that would be the reason.  I think it either has
> not been sent upstream, it when it was it was missed and not resent.
>
> I have added it to my tree, with appropriate changes to the comment.
>
> However I seem to be a bit thick today and cannot see where the
> overflow is happening.
> dqblk is 6 u_int32_t's and 2 time_t's
> struct rquota (after rq_bhardlimit) is 8 u_int's
>
> On what arch are there different?
> (maybe time_t isn't 32bits everwhere, is that it?)

the overflow occurs on 64bit arches due to the size differences in time_t ... 
for original description of the issue and author of the patch, please see 
(sorry, should have included this in the first e-mail):
http://bugs.gentoo.org/72113
-mike


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: rquota overflow fix never applied ?

[Trond Myklebust]

ty den 30.08.2005 Klokka 16:09 (+1000) skreiv Neil Brown:

> However I seem to be a bit thick today and cannot see where the
> overflow is happening.
> dqblk is 6 u_int32_t's and 2 time_t's

Isn't time_t defined to be unsigned long?

> struct rquota (after rq_bhardlimit) is 8 u_int's

Whether or not it fixes the particular problem it claims to, this is a
patch we should apply (or we should write something similar).

It is just evil to do direct memcpy between different structures. As
soon as someone does something that changes field alignments, starts
appending new fields,... on one structure but not the other, you
immediately get into trouble.

Cheers,
  Trond



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: rquota overflow fix never applied ?

[Neil Brown]

(drat ... sent this with the wrong 'from' address first time and
as nfs-utils is a closed list (grumble grumble) it bounced...
)

On Tuesday August 30, trond.myklebust@fys.uio.no wrote:
> ty den 30.08.2005 Klokka 16:09 (+1000) skreiv Neil Brown:
> 
> > However I seem to be a bit thick today and cannot see where the
> > overflow is happening.
> > dqblk is 6 u_int32_t's and 2 time_t's
> 
> Isn't time_t defined to be unsigned long?
> 
> > struct rquota (after rq_bhardlimit) is 8 u_int's
> 
> Whether or not it fixes the particular problem it claims to, this is a
> patch we should apply (or we should write something similar).

True, and I have now committed it to CVS.
It's just that I like to make sure that I understand a problem
completely before 'fixing' it - it is very easy to miss little details
(though I cannot see any room for hidden details here).

NeilBrown


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs