From: Petr Malat <oss@malat.biz>
Date: Fri, 13 Mar 2020 20:24:43 +0000 (+0100)
Subject: NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
X-Git-Tag: v4.9.217~90
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dbfc9e9878561da92cdcda41f321137c16966587;p=thirdparty%2Fkernel%2Fstable.git

NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array

Array is mapped by nfs_readdir_get_array(), the further kmap is a result
of a bad merge and should be removed.

This resource leakage can be exploited for DoS by receptively reading
a content of a directory on NFS (e.g. by running ls).

Fixes: 67a56e9743171 ("NFS: Fix memory leaks and corruption in readdir")
Signed-off-by: Petr Malat <oss@malat.biz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index c2665d920cf8c..2517fcd423b68 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -678,8 +678,6 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
 		goto out_label_free;
 	}
 
-	array = kmap(page);
-
 	status = nfs_readdir_alloc_pages(pages, array_size);
 	if (status < 0)
 		goto out_release_array;