]> www.infradead.org Git - users/jedix/linux-maple.git/commit
Fix length of buffer copied in __nfs4_get_acl_uncached
authorSachin Prabhu <sprabhu@redhat.com>
Thu, 22 Mar 2012 16:46:28 +0000 (16:46 +0000)
committerMaxim Uvarov <maxim.uvarov@oracle.com>
Wed, 19 Dec 2012 13:36:27 +0000 (05:36 -0800)
commit0a6154aff983cc23abac47e7b34c1936eb512350
treec69e4acabeaf0695617e5d3d8938b826f8e58c05
parent936ae8f34a2be083595aa9136fe44ba46ee0d37c
Fix length of buffer copied in __nfs4_get_acl_uncached

Bug-db: 14798
CVE: CVE-2012-2375
(mainline commit 785d76dbd877fb3e631a26f67d86a2dd0c862f8e)
_copy_from_pages() used to copy data from the temporary buffer to the
user passed buffer is passed the wrong size parameter when copying
data. res.acl_len contains both the bitmap and acl lenghts while
acl_len contains the acl length after adjusting for the bitmap size.

Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
fs/nfs/nfs4proc.c