Commit 43c1031f authored by Trond Myklebust's avatar Trond Myklebust
Browse files

NFSv4.2: Fix a memory stomp in decode_attr_security_label 



We must not change the value of label->len if it is zero, since that
indicates we stored a label.

Fixes: b4487b93 ("nfs: Fix getxattr kernel panic and memory overflow")
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
parent c8a62f44

fs/nfs/nfs4xdr.c

+4 −6
Original line number Diff line number Diff line
@@ -4236,12 +4236,10 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, 
			return -EIO;

		bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;

		if (len < NFS4_MAXLABELLEN) {

			if (label) {

				if (label->len) {

			if (label && label->len) {

				if (label->len < len)

					return -ERANGE;

				memcpy(label->label, p, len);

				}

				label->len = len;

				label->pi = pi;

				label->lfs = lfs;