Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257476?usp=email ) Change subject: client_mgr: prevent heap overflow in grpc_cltmgr_show_clients ...................................................................... client_mgr: prevent heap overflow in grpc_cltmgr_show_clients grpc_cltmgr_show_clients() performs two separate foreach_gsh_client() passes without holding client_by_ip.cip_lock across both passes. In pass 1 it counts active clients and allocates show->clients for that count; in pass 2 it populates show->clients via grpc_show_fill_cb(). If new clients connect between pass 1 and pass 2, grpc_show_fill_cb() increments st->index past the allocated show->clients array capacity, causing a heap buffer overflow. Conversely, if clients are removed between pass 1 and pass 2, show->client_count remains larger than fill_st.index, leaving trailing array elements uninitialized. Track max_count in struct grpc_show_fill_state, stop iterating in grpc_show_fill_cb() once st->index reaches st->max_count, and update show->client_count to fill_st.index after pass 2 completes. Change-Id: Idff3fbb409ba87348823ecbddefa834fa77cf61e Signed-off-by: Jim Chen <czcbangkai@google.com> --- M src/support/client_mgr.c 1 file changed, 9 insertions(+), 1 deletion(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/76/1257476/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257476?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Idff3fbb409ba87348823ecbddefa834fa77cf61e Gerrit-Change-Number: 1257476 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai@google.com>