From patchwork Mon Oct 5 15:26:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 268109 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DA68C4363A for ; Mon, 5 Oct 2020 15:42:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E92A420639 for ; Mon, 5 Oct 2020 15:42:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601912571; bh=WOPACfdw1elRPkcdeseAImdaZvZMg9Hr8B8wAVIDeBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=MePpYCxpg2o7cxBo9vewb8CA9r9f3QD0VTKfLBqKnZ2iK9l2Q0iF3gaJEDv1pt9np lJo4R6CBQv7a8om9z0yMVKTak+mvGli0UIyyjqmE0lIlJ2GfofcnKgc8hqUNCLCxhI 5LCbx0hg3F3PzFS3fl3qDZ4FcR20yOuNkKxyoLaQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727234AbgJEP1h (ORCPT ); Mon, 5 Oct 2020 11:27:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:52120 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726760AbgJEP1b (ORCPT ); Mon, 5 Oct 2020 11:27:31 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 53D8C208C7; Mon, 5 Oct 2020 15:27:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601911650; bh=WOPACfdw1elRPkcdeseAImdaZvZMg9Hr8B8wAVIDeBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fKbLztvDCxe/ZNHrimd2xGNZdnJspWvbIt7dwhaH1ISF3/Q1bfguQID+5Od849Nsg vQkQs1db6v315uw0f5TgUI6wK5at0dJW/O1iZSC31WI4X0lFU4JF4/RRdeGGsCwRLi IXLKShGizetohYE7Ng6nie+lRm9QjWg0Str3IpZg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeffrey Mitchell , Trond Myklebust , Sasha Levin Subject: [PATCH 4.19 25/38] nfs: Fix security label length not being reset Date: Mon, 5 Oct 2020 17:26:42 +0200 Message-Id: <20201005142109.883366324@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201005142108.650363140@linuxfoundation.org> References: <20201005142108.650363140@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jeffrey Mitchell [ Upstream commit d33030e2ee3508d65db5644551435310df86010e ] nfs_readdir_page_filler() iterates over entries in a directory, reusing the same security label buffer, but does not reset the buffer's length. This causes decode_attr_security_label() to return -ERANGE if an entry's security label is longer than the previous one's. This error, in nfs4_decode_dirent(), only gets passed up as -EAGAIN, which causes another failed attempt to copy into the buffer. The second error is ignored and the remaining entries do not show up in ls, specifically the getdents64() syscall. Reproduce by creating multiple files in NFS and giving one of the later files a longer security label. ls will not see that file nor any that are added afterwards, though they will exist on the backend. In nfs_readdir_page_filler(), reset security label buffer length before every reuse Signed-off-by: Jeffrey Mitchell Fixes: b4487b935452 ("nfs: Fix getxattr kernel panic and memory overflow") Signed-off-by: Trond Myklebust Signed-off-by: Sasha Levin --- fs/nfs/dir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c index 4ae726e70d873..733fd9e4f0a15 100644 --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -553,6 +553,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE); do { + if (entry->label) + entry->label->len = NFS4_MAXLABELLEN; + status = xdr_decode(desc, entry, &stream); if (status != 0) { if (status == -EAGAIN)