Commit 43c1031f authored by Trond Myklebust's avatar Trond Myklebust

NFSv4.2: Fix a memory stomp in decode_attr_security_label

We must not change the value of label->len if it is zero, since that
indicates we stored a label.

Fixes: b4487b93 ("nfs: Fix getxattr kernel panic and memory overflow")
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent c8a62f44
...@@ -4236,12 +4236,10 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, ...@@ -4236,12 +4236,10 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
return -EIO; return -EIO;
bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL; bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
if (len < NFS4_MAXLABELLEN) { if (len < NFS4_MAXLABELLEN) {
if (label) { if (label && label->len) {
if (label->len) { if (label->len < len)
if (label->len < len) return -ERANGE;
return -ERANGE; memcpy(label->label, p, len);
memcpy(label->label, p, len);
}
label->len = len; label->len = len;
label->pi = pi; label->pi = pi;
label->lfs = lfs; label->lfs = lfs;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment