NFSv4.2: Fix a memory stomp in decode_attr_security_label
We must not change the value of label->len if it is zero, since that
indicates we stored a label.
Fixes: b4487b9354
("nfs: Fix getxattr kernel panic and memory overflow")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
This commit is contained in:
Родитель
c8a62f4402
Коммит
43c1031f71
|
@ -4236,12 +4236,10 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
|
|||
return -EIO;
|
||||
bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
|
||||
if (len < NFS4_MAXLABELLEN) {
|
||||
if (label) {
|
||||
if (label->len) {
|
||||
if (label && label->len) {
|
||||
if (label->len < len)
|
||||
return -ERANGE;
|
||||
memcpy(label->label, p, len);
|
||||
}
|
||||
label->len = len;
|
||||
label->pi = pi;
|
||||
label->lfs = lfs;
|
||||
|
|
Загрузка…
Ссылка в новой задаче