NFSv4.2: Fix a memory stomp in decode_attr_security_label

[ Upstream commit 43c1031f7110967c240cb6e922adcfc4b8899183 ]

We must not change the value of label->len if it is zero, since that
indicates we stored a label.

Fixes: 4fc0fda92d04 ("nfs: Fix getxattr kernel panic and memory overflow")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index ac9ffe18445146e67ee57c2e08ce297e8608942c..a3592becae4a503e942debfa7e88243f297ef4ba 100644 (file)
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4171,12 +4171,10 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
                        return -EIO;
                bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
                if (len < NFS4_MAXLABELLEN) {
-                       if (label) {
-                               if (label->len) {
-                                       if (label->len < len)
-                                               return -ERANGE;
-                                       memcpy(label->label, p, len);
-                               }
+                       if (label && label->len) {
+                               if (label->len < len)
+                                       return -ERANGE;
+                               memcpy(label->label, p, len);
                                label->len = len;
                                label->pi = pi;
                                label->lfs = lfs;