Commit b2b472bc authored Oct 18, 2022 by Trond Myklebust Committed by Greg Kroah-Hartman Jan 18, 2023

NFSv4.2: Fix a memory stomp in decode_attr_security_label



[ Upstream commit 43c1031f7110967c240cb6e922adcfc4b8899183 ]

We must not change the value of label->len if it is zero, since that
indicates we stored a label.

Fixes: b4487b935452 ("nfs: Fix getxattr kernel panic and memory overflow")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 96f3c706

fs/nfs/nfs4xdr.c

+4 −6

Original line number	Diff line number	Diff line
		@@ -4171,12 +4171,10 @@ static int decode_attr_security_label(struct xdr_stream xdr, uint32_t bitmap,
		return -EIO;
		bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
		if (len < NFS4_MAXLABELLEN) {
		if (label) {
		if (label->len) {
		if (label && label->len) {
		if (label->len < len)
		return -ERANGE;
		memcpy(label->label, p, len);
		}
		label->len = len;
		label->pi = pi;
		label->lfs = lfs;