]> git.baikalelectronics.ru Git - kernel.git/commit
Avoid reading past buffer when calling GETACL
authorSachin Prabhu <sprabhu@redhat.com>
Tue, 17 Apr 2012 13:35:39 +0000 (14:35 +0100)
committerTrond Myklebust <Trond.Myklebust@netapp.com>
Fri, 27 Apr 2012 17:15:07 +0000 (13:15 -0400)
commit9c4baefdb3c0779a073e641b7b7ccb6a37f81279
tree9cc6df10ac849488efe28ea811e55c213c22a754
parent6b15578a0a2e4f788bb79d8a45b244489b3a286b
Avoid reading past buffer when calling GETACL

Bug noticed in commit
995614f2fb94b6dd2d778b0f47790ea688d970dd

When calling GETACL, if the size of the bitmap array, the length
attribute and the acl returned by the server is greater than the
allocated buffer(args.acl_len), we can Oops with a General Protection
fault at _copy_from_pages() when we attempt to read past the pages
allocated.

This patch allocates an extra PAGE for the bitmap and checks to see that
the bitmap + attribute_length + ACLs don't exceed the buffer space
allocated to it.

Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Reported-by: Jian Li <jiali@redhat.com>
[Trond: Fixed a size_t vs unsigned int printk() warning]
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
fs/nfs/nfs4proc.c
fs/nfs/nfs4xdr.c