lkml.org 
[lkml]   [2020]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 205/212] nfs: Fix getxattr kernel panic and memory overflow
    Date
    From: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>

    [ Upstream commit b4487b93545214a9db8cbf32e86411677b0cca21 ]

    Move the buffer size check to decode_attr_security_label() before memcpy()
    Only call memcpy() if the buffer is large enough

    Fixes: aa9c2669626c ("NFS: Client implementation of Labeled-NFS")
    Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
    [Trond: clean up duplicate test of label->len != 0]
    Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/nfs/nfs4proc.c | 2 --
    fs/nfs/nfs4xdr.c | 6 +++++-
    2 files changed, 5 insertions(+), 3 deletions(-)

    diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
    index c189722bf9c71..714457bb1440a 100644
    --- a/fs/nfs/nfs4proc.c
    +++ b/fs/nfs/nfs4proc.c
    @@ -5212,8 +5212,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
    return ret;
    if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
    return -ENOENT;
    - if (buflen < label.len)
    - return -ERANGE;
    return 0;
    }

    diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
    index d7f8d5ce30e3e..0a7c4e30a385e 100644
    --- a/fs/nfs/nfs4xdr.c
    +++ b/fs/nfs/nfs4xdr.c
    @@ -4163,7 +4163,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
    goto out_overflow;
    if (len < NFS4_MAXLABELLEN) {
    if (label) {
    - memcpy(label->label, p, len);
    + if (label->len) {
    + if (label->len < len)
    + return -ERANGE;
    + memcpy(label->label, p, len);
    + }
    label->len = len;
    label->pi = pi;
    label->lfs = lfs;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-20 13:27    [W:2.319 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site