nfsd4: fix acl buffer overrun (09bdc2d7) · Commits · 戴 / test

"nfsd: use get_acl and ->set_acl" forgets to set the size in the case get_acl() succeeds, so _posix_to_nfsv4_one() can then write past the end of its allocation. Symptoms were slab corruption warnings. Also, some minor cleanup while we're here. (Among other things, note that the first few lines guarantee that pacl is non-NULL.) Signed-off-by:

J. Bruce Fields <bfields@redhat.com>

fs/nfsd/nfs4acl.c

+3 −6

Original line number	Diff line number	Diff line
		@@ -151,17 +151,15 @@ nfsd4_get_nfs4_acl(struct svc_rqst rqstp, struct dentry dentry,
		pacl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);
		if (IS_ERR(pacl))
		return PTR_ERR(pacl);
		}
		/* allocate for worst case: one (deny, allow) pair each: */
		size += 2 * pacl->a_count;
		}

		if (S_ISDIR(inode->i_mode)) {
		flags = NFS4_ACL_DIR;
		dpacl = get_acl(inode, ACL_TYPE_DEFAULT);
		if (dpacl)
		size += 2 * dpacl->a_count;
		} else {
		dpacl = NULL;
		}

		*acl = nfs4_acl_new(size);
		@@ -170,7 +168,6 @@ nfsd4_get_nfs4_acl(struct svc_rqst rqstp, struct dentry dentry,
		goto out;
		}

		if (pacl)
		_posix_to_nfsv4_one(pacl, *acl, flags & ~NFS4_ACL_TYPE_DEFAULT);

		if (dpacl)

Admin message