NFSv4: Possible buffer overflow in security label decode.

[Nazarov Sergey <s-nazarov@yandex.ru>]

Hi!
Buffer overflow possible in decode_attr_security_label, if given label buffer size is not enough to
store data received from server. This adds additional check for buffer capacity:
---
 fs/nfs/nfs4xdr.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 4e44412..6a6302b 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4157,7 +4157,9 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
 		if (unlikely(!p))
 			goto out_overflow;
 		if (len < NFS4_MAXLABELLEN) {
-			if (label) {
+			if (label && label->label) {
+				if (len > label->len)
+					return -ERANGE;
 				memcpy(label->label, p, len);
 				label->len = len;
 				label->pi = pi;
@@ -4165,9 +4167,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
 				status = NFS_ATTR_FATTR_V4_SECURITY_LABEL;
 			}
 			bitmap[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
-		} else
+		} else {
 			printk(KERN_WARNING "%s: label too long (%u)!\n",
 					__func__, len);
+			return -EIO;
+		}
 	}
 	if (label && label->label)
 		dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
--