Hi Sergey,
On Wed, Dec 9, 2015 at 7:33 AM, Nazarov Sergey <s-nazarov@xxxxxxxxx> wrote:
> Hi!
> Buffer overflow possible in decode_attr_security_label, if given label buffer size is not enough to
> store data received from server. This adds additional check for buffer capacity:
> ---
> fs/nfs/nfs4xdr.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
> index 4e44412..6a6302b 100644
> --- a/fs/nfs/nfs4xdr.c
> +++ b/fs/nfs/nfs4xdr.c
> @@ -4157,7 +4157,9 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
> if (unlikely(!p))
> goto out_overflow;
> if (len < NFS4_MAXLABELLEN) {
> - if (label) {
> + if (label && label->label) {
> + if (len > label->len)
> + return -ERANGE;
> memcpy(label->label, p, len);
> label->len = len;
> label->pi = pi;
> @@ -4165,9 +4167,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
> status = NFS_ATTR_FATTR_V4_SECURITY_LABEL;
> }
> bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
> - } else
> + } else {
> printk(KERN_WARNING "%s: label too long (%u)!\n",
> __func__, len);
> + return -EIO;
> + }
> }
> if (label && label->label)
> dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
> --
Looks good, but could you please add a Signed-off-by: line as per the
instructions in Documentation/SubmittingPatches?
Thanks!
Trond
--
Trond Myklebust
Linux NFS client maintainer, PrimaryData
trond.myklebust@xxxxxxxxxxxxxxx
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
