diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2021-11-14 15:16:04 -0500 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2021-11-15 15:33:10 -0500 |
| commit | c0019b7db1d7ac62c711cda6b357a659d46428fe (patch) | |
| tree | 89686f8c5bb9f59109ca919a3539c89c31d06b22 /tools/perf/scripts/python/stackcollapse.py | |
| parent | 80479eb862102f9513e93fcf726c78cc0be2e3b2 (diff) | |
NFSD: Fix exposure in nfsd4_decode_bitmap()
rtm@csail.mit.edu reports:
> nfsd4_decode_bitmap4() will write beyond bmval[bmlen-1] if the RPC
> directs it to do so. This can cause nfsd4_decode_state_protect4_a()
> to write client-supplied data beyond the end of
> nfsd4_exchange_id.spo_must_allow[] when called by
> nfsd4_decode_exchange_id().
Rewrite the loops so nfsd4_decode_bitmap() cannot iterate beyond
@bmlen.
Reported by: rtm@csail.mit.edu
Fixes: d1c263a031e8 ("NFSD: Replace READ* macros in nfsd4_decode_fattr()")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions