]> git.karo-electronics.de Git - karo-tx-linux.git/commit
NFSv4: Check for buffer length in __nfs4_get_acl_uncached
authorSven Wegener <sven.wegener@stealer.net>
Sat, 8 Dec 2012 14:30:18 +0000 (15:30 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 11 Jan 2013 17:18:36 +0000 (09:18 -0800)
commit43d1640924a2bd61e5f8ad156930353bd410e36d
tree68d5de18d373d6bb00e89b1719b1950f3ecd85f3
parent62ec24f42255d4c140a77f206068b76262c01c53
NFSv4: Check for buffer length in __nfs4_get_acl_uncached

commit 7d3e91a89b7adbc2831334def9e494dd9892f9af upstream.

Commit 1f1ea6c "NFSv4: Fix buffer overflow checking in
__nfs4_get_acl_uncached" accidently dropped the checking for too small
result buffer length.

If someone uses getxattr on "system.nfs4_acl" on an NFSv4 mount
supporting ACLs, the ACL has not been cached and the buffer suplied is
too short, we still copy the complete ACL, resulting in kernel and user
space memory corruption.

Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/nfs/nfs4proc.c