Messages in this thread Patch in this message |  | | | Date | Wed, 3 Sep 2008 10:32:52 -0700 | | From | Greg KH <> | | Subject | [patch 05/16] nfsd: fix buffer overrun decoding NFSv4 acl |
2.6.25-stable review patch. If anyone has any objections, please let us know.
------------------
From: J. Bruce Fields <bfields@citi.umich.edu>
commit 91b80969ba466ba4b915a4a1d03add8c297add3f upstream
The array we kmalloc() here is not large enough.
Thanks to Johann Dahm and David Richter for bug report and testing.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Cc: David Richter <richterd@citi.umich.edu>
Tested-by: Johann Dahm <jdahm@umich.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/nfsd/nfs4acl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state
* enough space for either:
*/
alloc = sizeof(struct posix_ace_state_array)
- + cnt*sizeof(struct posix_ace_state);
+ + cnt*sizeof(struct posix_user_ace_state);
state->users = kzalloc(alloc, GFP_KERNEL);
if (!state->users)
return -ENOMEM;
--
|  |