Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 89730466 authored by Jeffrey Mitchell's avatar Jeffrey Mitchell Committed by Greg Kroah-Hartman
Browse files

nfs: Fix getxattr kernel panic and memory overflow 



[ Upstream commit b4487b93545214a9db8cbf32e86411677b0cca21 ]

Move the buffer size check to decode_attr_security_label() before memcpy()
Only call memcpy() if the buffer is large enough

Fixes: aa9c2669 ("NFS: Client implementation of Labeled-NFS")
Signed-off-by: default avatarJeffrey Mitchell <jeffrey.mitchell@starlab.io>
[Trond: clean up duplicate test of label->len != 0]
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent a37ac4f1

fs/nfs/nfs4proc.c

+0 −2
Original line number Diff line number Diff line
@@ -5212,8 +5212,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf, 
		return ret;

	if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))

		return -ENOENT;

	if (buflen < label.len)

		return -ERANGE;

	return 0;

}

fs/nfs/nfs4xdr.c

+5 −1
Original line number Diff line number Diff line
@@ -4163,7 +4163,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, 
			goto out_overflow;

		if (len < NFS4_MAXLABELLEN) {

			if (label) {

				if (label->len) {

					if (label->len < len)

						return -ERANGE;

					memcpy(label->label, p, len);

				}

				label->len = len;

				label->pi = pi;

				label->lfs = lfs;