lkml.org 
[lkml]   [2008]   [Sep]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 05/16] nfsd: fix buffer overrun decoding NFSv4 acl
    2.6.25-stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: J. Bruce Fields <bfields@citi.umich.edu>

    commit 91b80969ba466ba4b915a4a1d03add8c297add3f upstream

    The array we kmalloc() here is not large enough.

    Thanks to Johann Dahm and David Richter for bug report and testing.

    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
    Cc: David Richter <richterd@citi.umich.edu>
    Tested-by: Johann Dahm <jdahm@umich.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/nfsd/nfs4acl.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/nfsd/nfs4acl.c
    +++ b/fs/nfsd/nfs4acl.c
    @@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state
    * enough space for either:
    */
    alloc = sizeof(struct posix_ace_state_array)
    - + cnt*sizeof(struct posix_ace_state);
    + + cnt*sizeof(struct posix_user_ace_state);
    state->users = kzalloc(alloc, GFP_KERNEL);
    if (!state->users)
    return -ENOMEM;
    --


    \
     
     \ /
      Last update: 2008-09-03 19:53    [W:0.019 / U:29.524 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site