]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
nfsd4: fix acl buffer overrun
authorJ. Bruce Fields <bfields@redhat.com>
Tue, 11 Feb 2014 16:29:05 +0000 (11:29 -0500)
committerJ. Bruce Fields <bfields@redhat.com>
Tue, 11 Feb 2014 18:48:11 +0000 (13:48 -0500)
4ac7249ea5a0ceef9f8269f63f33cc873c3fac61 "nfsd: use get_acl and
->set_acl" forgets to set the size in the case get_acl() succeeds, so
_posix_to_nfsv4_one() can then write past the end of its allocation.
Symptoms were slab corruption warnings.

Also, some minor cleanup while we're here.  (Among other things, note
that the first few lines guarantee that pacl is non-NULL.)

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
fs/nfsd/nfs4acl.c

index d3a587144222b56becd0ce82597fb95bc8767592..d190e33d0ec2fdeb845eec70ab3c610ab551758d 100644 (file)
@@ -151,17 +151,15 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
                pacl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);
                if (IS_ERR(pacl))
                        return PTR_ERR(pacl);
-               /* allocate for worst case: one (deny, allow) pair each: */
-               size += 2 * pacl->a_count;
        }
+       /* allocate for worst case: one (deny, allow) pair each: */
+       size += 2 * pacl->a_count;
 
        if (S_ISDIR(inode->i_mode)) {
                flags = NFS4_ACL_DIR;
                dpacl = get_acl(inode, ACL_TYPE_DEFAULT);
                if (dpacl)
                        size += 2 * dpacl->a_count;
-       } else {
-               dpacl = NULL;
        }
 
        *acl = nfs4_acl_new(size);
@@ -170,8 +168,7 @@ nfsd4_get_nfs4_acl(struct svc_rqst *rqstp, struct dentry *dentry,
                goto out;
        }
 
-       if (pacl)
-               _posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT);
+       _posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT);
 
        if (dpacl)
                _posix_to_nfsv4_one(dpacl, *acl, flags | NFS4_ACL_TYPE_DEFAULT);