[BUG] Out of bound read of size 1 in __d_alloc function which further leads to __default_memcpy function

[Neeraj Pal]

Hi Jules and Sascha,

Thanks for your patches.
I have switched to the next branch and confirmed the issues. Not able
to reproduce them now. Fixed.

following are the observations:

barebox at Sandbox:/ cat ""
could not open : Invalid argument
barebox at Sandbox:/ nfs file ""
open: Invalid argument
barebox at Sandbox:/

barebox at Sandbox:/ sh /mnt/nfs/ff2
check NFS failed: Out of memory

barebox at Sandbox:/ cat /mnt/nfs/ff2
nfs AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB
ko
barebox at Sandbox:/
barebox at Sandbox:/ nfs AA BB
NFS failed: Out of memory


The above error is coming from the do_nfs() in net/nfs.c#L740 as given below:

   734        }
   735
   736        net_unregister(nfs_con);
   737    err_udp:
   738        close(net_store_fd);
   739        if (nfs_err) {
   740            printf("NFS failed: %s\n", strerror(-nfs_err));
   741            unlink(localfile);
   742        }

Please confirm and let me know for further information.

Thanks & Regards,
Neeraj


On Mon, May 10, 2021 at 3:48 PM Jules Maselbas <jmaselbas at kalray.eu> wrote:
>
> Hi,
>
> On Fri, May 07, 2021 at 12:58:30PM +0200, Sascha Hauer wrote:
> > Hi,
> >
> > On Sun, Apr 18, 2021 at 01:10:10AM +0530, Neeraj Pal wrote:
> > > Hi,
> > >
> > > I have found the Out of bound read issue of size 1 when argv[2] is "" in
> > > __d_alloc function fs/fs.c:1254 which further goes
> > > and crashes into  __default_memcpy call lib/string.c:562
> > >
> > > Tested on:
> > > - barebox-2021.04.0
> > > - git commit af0f068a6edad45b033e772056ac0352e1ba3613
> >
> > I can reproduce this here. Thanks for reporting it. I just sent out a
> > series fixing this issue, you are on Cc:
> I think this should also be fixed by the patch I've sent:
> (74946415a "fs: Fix link_path_walk to return -ENOENT on empty path")
>
> This patch might not have fixed this exact case when running the nfs
> command. Have you been able to repoduce this issue with this patch
> applied ?
>
> I've havn't tried to setup a net interface to debug nfs commandi,
> instead I was using simpler command such as `md5sum ""`.
>
> Best,
> Jules
>