]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
nfs: Fix security label length not being reset
authorJeffrey Mitchell <jeffrey.mitchell@starlab.io>
Tue, 15 Sep 2020 21:42:52 +0000 (16:42 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 14 Oct 2020 07:46:20 +0000 (09:46 +0200)
commitc8bf391fcdd18466363d493922a9ba500aeb17fd
treecc19bba5bc19285c83f4ede9fb08a6e919af146a
parenteaf09b94a7d77e6a97a7b4b783c551a57989ea26
nfs: Fix security label length not being reset

[ Upstream commit d33030e2ee3508d65db5644551435310df86010e ]

nfs_readdir_page_filler() iterates over entries in a directory, reusing
the same security label buffer, but does not reset the buffer's length.
This causes decode_attr_security_label() to return -ERANGE if an entry's
security label is longer than the previous one's. This error, in
nfs4_decode_dirent(), only gets passed up as -EAGAIN, which causes another
failed attempt to copy into the buffer. The second error is ignored and
the remaining entries do not show up in ls, specifically the getdents64()
syscall.

Reproduce by creating multiple files in NFS and giving one of the later
files a longer security label. ls will not see that file nor any that are
added afterwards, though they will exist on the backend.

In nfs_readdir_page_filler(), reset security label buffer length before
every reuse

Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
Fixes: b4487b935452 ("nfs: Fix getxattr kernel panic and memory overflow")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/nfs/dir.c