From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes-a5Mqy2EUIFVAfugRpC6u6w@public.gmane.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw-lrwSPXAIdEw7YuNMryXyOw@public.gmane.org>,
Chris Wedgwood <reviews-vFB7bnJMxjixIvdkapsUdQ@public.gmane.org>,
Michael Krufky <mkrufky-dJidKbW2IEtAfugRpC6u6w@public.gmane.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>, Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco
<rbranco-OG872enO0lhw4vQD1pnt9QC/G2K4zDHf@public.gmane.org>,
Jake Edge <jake-T1hC0tSOHrs@public.gmane.org>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, linux-nfs@vger.kernel.org,
"J. Bruce Fields" <bfields@citi.umich.edu>,
David Richter <richterd@citi.umich.edu>
Subject: [patch 05/16] nfsd: fix buffer overrun decoding NFSv4 acl
Date: Wed, 3 Sep 2008 10:32:52 -0700 [thread overview]
Message-ID: <20080903173252.GF10429@suse.de> (raw)
In-Reply-To: <20080903173218.GA10429@suse.de>
2.6.25-stable review patch. If anyone has any objections, please let us know.
------------------
From: J. Bruce Fields <bfields@citi.umich.edu>
commit 91b80969ba466ba4b915a4a1d03add8c297add3f upstream
The array we kmalloc() here is not large enough.
Thanks to Johann Dahm and David Richter for bug report and testing.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Cc: David Richter <richterd@citi.umich.edu>
Tested-by: Johann Dahm <jdahm@umich.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/nfsd/nfs4acl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state
* enough space for either:
*/
alloc = sizeof(struct posix_ace_state_array)
- + cnt*sizeof(struct posix_ace_state);
+ + cnt*sizeof(struct posix_user_ace_state);
state->users = kzalloc(alloc, GFP_KERNEL);
if (!state->users)
return -ENOMEM;
--
WARNING: multiple messages have this Message-ID (diff)
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>, Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>, Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, linux-nfs@vger.kernel.org,
"J. Bruce Fields" <bfields@citi.umich.edu>,
David Richter <richterd@citi.umich.edu>
Subject: [patch 05/16] nfsd: fix buffer overrun decoding NFSv4 acl
Date: Wed, 3 Sep 2008 10:32:52 -0700 [thread overview]
Message-ID: <20080903173252.GF10429@suse.de> (raw)
In-Reply-To: <20080903173218.GA10429@suse.de>
[-- Attachment #1: nfsd-fix-buffer-overrun-decoding-nfsv4-acl.patch --]
[-- Type: text/plain, Size: 967 bytes --]
2.6.25-stable review patch. If anyone has any objections, please let us know.
------------------
From: J. Bruce Fields <bfields@citi.umich.edu>
commit 91b80969ba466ba4b915a4a1d03add8c297add3f upstream
The array we kmalloc() here is not large enough.
Thanks to Johann Dahm and David Richter for bug report and testing.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Cc: David Richter <richterd@citi.umich.edu>
Tested-by: Johann Dahm <jdahm@umich.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/nfsd/nfs4acl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state
* enough space for either:
*/
alloc = sizeof(struct posix_ace_state_array)
- + cnt*sizeof(struct posix_ace_state);
+ + cnt*sizeof(struct posix_user_ace_state);
state->users = kzalloc(alloc, GFP_KERNEL);
if (!state->users)
return -ENOMEM;
--
next prev parent reply other threads:[~2008-09-03 17:50 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20080903172849.927077124@mini.kroah.org>
2008-09-03 17:32 ` [patch 00/16] 2.6.25-stable review Greg KH
2008-09-03 17:32 ` [patch 01/16] x86: work around MTRR mask setting Greg KH
2008-09-03 17:32 ` [patch 02/16] USB: cdc-acm: dont unlock acm->mutex on error path Greg KH
2008-09-03 17:32 ` [patch 03/16] sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports Greg KH
2008-09-03 17:32 ` Greg KH
2008-09-03 17:32 ` [patch 04/16] r8169: balance pci_map / pci_unmap pair Greg KH
2008-09-03 17:32 ` Greg KH [this message]
2008-09-03 17:32 ` [patch 05/16] nfsd: fix buffer overrun decoding NFSv4 acl Greg KH
2008-09-03 17:32 ` [patch 06/16] mm: make setup_zone_migrate_reserve() aware of overlapping nodes Greg KH
2008-09-03 17:32 ` [patch 07/16] forcedeth: fix checksum flag Greg KH
2008-09-03 17:32 ` [patch 08/16] fbdefio: add set_page_dirty handler to deferred IO FB Greg KH
2008-09-03 17:33 ` [patch 09/16] crypto: authenc - Avoid using clobbered request pointer Greg KH
2008-09-03 17:33 ` [patch 10/16] cramfs: fix named-pipe handling Greg KH
2008-09-03 17:33 ` [patch 11/16] cifs: fix O_APPEND on directio mounts Greg KH
2008-09-03 17:33 ` [patch 12/16] sctp: fix potential panics in the SCTP-AUTH API Greg KH
2008-09-03 17:33 ` [patch 13/16] sctp: add verification checks to SCTP_AUTH_KEY option Greg KH
2008-09-03 17:33 ` [patch 14/16] sctp: correct bounds check in sctp_setsockopt_auth_key Greg KH
2008-09-03 17:33 ` [patch 15/16] sctp: fix random memory dereference with SCTP_HMAC_IDENT option Greg KH
2008-09-03 17:33 ` [patch 16/16] sch_prio: Fix nla_parse_nested_compat() regression Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080903173252.GF10429@suse.de \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=bfields@citi.umich.edu \
--cc=cavokz@gmail.com \
--cc=cebbert@redhat.com \
--cc=chuckw-lrwSPXAIdEw7YuNMryXyOw@public.gmane.org \
--cc=davej@redhat.com \
--cc=eteo@redhat.com \
--cc=jake-T1hC0tSOHrs@public.gmane.org \
--cc=jmforbes-a5Mqy2EUIFVAfugRpC6u6w@public.gmane.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=mkrufky-dJidKbW2IEtAfugRpC6u6w@public.gmane.org \
--cc=rbranco-OG872enO0lhw4vQD1pnt9QC/G2K4zDHf@public.gmane.org \
--cc=rdunlap@xenotime.net \
--cc=reviews-vFB7bnJMxjixIvdkapsUdQ@public.gmane.org \
--cc=richterd@citi.umich.edu \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=w@1wt.eu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.