Commit 64a817cf authored Mar 26, 2013 by J. Bruce Fields

nfsd4: reject "negative" acl lengths



Since we only enforce an upper bound, not a lower bound, a "negative"
length can get through here.

The symptom seen was a warning when we attempt to a kmalloc with an
excessive size.

Reported-by: Toralf Förster <toralf.foerster@gmx.de>
Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

parent e49dbbf3

fs/nfsd/nfs4xdr.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -264,7 +264,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs argp, u32 bmval,
	iattr->ia_valid \|= ATTR_SIZE;		iattr->ia_valid \|= ATTR_SIZE;
	}		}
	if (bmval[0] & FATTR4_WORD0_ACL) {		if (bmval[0] & FATTR4_WORD0_ACL) {
	int nace;		u32 nace;
	struct nfs4_ace *ace;		struct nfs4_ace *ace;

	READ_BUF(4); len += 4;		READ_BUF(4); len += 4;