summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorIlya Dryomov <idryomov@gmail.com>2018-07-27 13:45:36 -0400
committerIlya Dryomov <idryomov@gmail.com>2018-08-02 15:33:26 -0400
commitf1d10e04637924f2b00a0fecdd2ca4565f5cfc3f (patch)
tree9622aae902ffee8fa1160ac12e364605f4f3cacc
parent130f52f2b203aa0aec179341916ffb2e905f3afd (diff)
libceph: weaken sizeof check in ceph_x_verify_authorizer_reply()
Allow for extending ceph_x_authorize_reply in the future. Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Sage Weil <sage@redhat.com>
-rw-r--r--net/ceph/auth_x.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 462786f571e7..b52732337ca6 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -737,8 +737,10 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
737 ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN); 737 ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN);
738 if (ret < 0) 738 if (ret < 0)
739 return ret; 739 return ret;
740 if (ret != sizeof(*reply)) 740 if (ret < sizeof(*reply)) {
741 return -EPERM; 741 pr_err("bad size %d for ceph_x_authorize_reply\n", ret);
742 return -EINVAL;
743 }
742 744
743 if (au->nonce + 1 != le64_to_cpu(reply->nonce_plus_one)) 745 if (au->nonce + 1 != le64_to_cpu(reply->nonce_plus_one))
744 ret = -EPERM; 746 ret = -EPERM;