Commit 09bdc2d7 authored by J. Bruce Fields's avatar J. Bruce Fields

nfsd4: fix acl buffer overrun

4ac7249e "nfsd: use get_acl and
->set_acl" forgets to set the size in the case get_acl() succeeds, so
_posix_to_nfsv4_one() can then write past the end of its allocation.
Symptoms were slab corruption warnings.

Also, some minor cleanup while we're here.  (Among other things, note
that the first few lines guarantee that pacl is non-NULL.)
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent b28a960c
...@@ -151,17 +151,15 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry, ...@@ -151,17 +151,15 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
pacl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL); pacl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);
if (IS_ERR(pacl)) if (IS_ERR(pacl))
return PTR_ERR(pacl); return PTR_ERR(pacl);
}
/* allocate for worst case: one (deny, allow) pair each: */ /* allocate for worst case: one (deny, allow) pair each: */
size += 2 * pacl->a_count; size += 2 * pacl->a_count;
}
if (S_ISDIR(inode->i_mode)) { if (S_ISDIR(inode->i_mode)) {
flags = NFS4_ACL_DIR; flags = NFS4_ACL_DIR;
dpacl = get_acl(inode, ACL_TYPE_DEFAULT); dpacl = get_acl(inode, ACL_TYPE_DEFAULT);
if (dpacl) if (dpacl)
size += 2 * dpacl->a_count; size += 2 * dpacl->a_count;
} else {
dpacl = NULL;
} }
*acl = nfs4_acl_new(size); *acl = nfs4_acl_new(size);
...@@ -170,7 +168,6 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry, ...@@ -170,7 +168,6 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
goto out; goto out;
} }
if (pacl)
_posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT); _posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT);
if (dpacl) if (dpacl)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment