lkml.org 
[lkml]   [2013]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 140/171 ] nfsd4: reject "negative" acl lengths
    3.6.11.2 stable review patch.
    If anyone has any objections, please let me know.

    ------------------

    From: "J. Bruce Fields" <bfields@redhat.com>

    [ Upstream commit 64a817cfbded8674f345d1117b117f942a351a69 ]

    Since we only enforce an upper bound, not a lower bound, a "negative"
    length can get through here.

    The symptom seen was a warning when we attempt to a kmalloc with an
    excessive size.

    Reported-by: Toralf Förster <toralf.foerster@gmx.de>
    Cc: stable@kernel.org
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    ---
    fs/nfsd/nfs4xdr.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
    index 6322df3..551b061 100644
    --- a/fs/nfsd/nfs4xdr.c
    +++ b/fs/nfsd/nfs4xdr.c
    @@ -263,7 +263,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
    iattr->ia_valid |= ATTR_SIZE;
    }
    if (bmval[0] & FATTR4_WORD0_ACL) {
    - int nace;
    + u32 nace;
    struct nfs4_ace *ace;

    READ_BUF(4); len += 4;
    --
    1.7.10.4

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2013-04-12 02:21    [W:7.854 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site