nfs: Fix getxattr kernel panic and memory overflow
[ Upstream commitb4487b9354
] Move the buffer size check to decode_attr_security_label() before memcpy() Only call memcpy() if the buffer is large enough Fixes:aa9c266962
("NFS: Client implementation of Labeled-NFS") Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io> [Trond: clean up duplicate test of label->len != 0] Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
d09d6dca89
commit
75cf7f895f
|
@ -5811,8 +5811,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
|
|||
return ret;
|
||||
if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
|
||||
return -ENOENT;
|
||||
if (buflen < label.len)
|
||||
return -ERANGE;
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
|
@ -4169,7 +4169,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
|
|||
return -EIO;
|
||||
if (len < NFS4_MAXLABELLEN) {
|
||||
if (label) {
|
||||
memcpy(label->label, p, len);
|
||||
if (label->len) {
|
||||
if (label->len < len)
|
||||
return -ERANGE;
|
||||
memcpy(label->label, p, len);
|
||||
}
|
||||
label->len = len;
|
||||
label->pi = pi;
|
||||
label->lfs = lfs;
|
||||
|
|
Loading…
Reference in New Issue