From e238325e949ef4eac85cd379cf26084fb20c2d67 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 30 Mar 2012 10:49:57 -0400 Subject: [PATCH] Add patch to fix incorrect buffer length in __nfs4_get_acl_uncached --- kernel.spec | 8 ++++- ...er-copied-in-__nfs4_get_acl_uncached.patch | 32 +++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch diff --git a/kernel.spec b/kernel.spec index 1270e937f..30cf5ff1e 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 8 +%global baserelease 9 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -785,6 +785,7 @@ Patch21371: iwlwifi-do-not-nulify-ctx-vif-on-reset.patch Patch21400: unhandled-irqs-switch-to-polling.patch Patch21500: ASPM-Fix-pcie-devs-with-non-pcie-children.patch +Patch21501: nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch Patch22000: weird-root-dentry-name-debug.patch @@ -1523,6 +1524,8 @@ ApplyPatch highbank-export-clock-functions.patch ApplyPatch ASPM-Fix-pcie-devs-with-non-pcie-children.patch +ApplyPatch nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch + # END OF PATCH APPLICATIONS %endif @@ -2362,6 +2365,9 @@ fi # '-' | | # '-' %changelog +* Fri Mar 30 2012 Josh Boyer +- Add patch to fix incorrect buffer length in __nfs4_get_acl_uncached + * Thu Mar 29 2012 Josh Boyer - 3.3.0-8 - Drop __cpuinitdata on disable_nx for x86_32 (rhbz 808075) - iwl{wifi,legacy}: Fix warnings on remove interface from Stanislaw Gruszka diff --git a/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch b/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch new file mode 100644 index 000000000..981f1f467 --- /dev/null +++ b/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch @@ -0,0 +1,32 @@ +From 20e0fa98b751facf9a1101edaefbc19c82616a68 Mon Sep 17 00:00:00 2001 +From: Sachin Prabhu +Date: Thu, 22 Mar 2012 16:46:28 +0000 +Subject: [PATCH] Fix length of buffer copied in __nfs4_get_acl_uncached + +_copy_from_pages() used to copy data from the temporary buffer to the +user passed buffer is passed the wrong size parameter when copying +data. res.acl_len contains both the bitmap and acl lenghts while +acl_len contains the acl length after adjusting for the bitmap size. + +Signed-off-by: Sachin Prabhu +Signed-off-by: Trond Myklebust +--- + fs/nfs/nfs4proc.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index e809d23..45df7d4 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3712,7 +3712,7 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu + if (acl_len > buflen) + goto out_free; + _copy_from_pages(buf, pages, res.acl_data_offset, +- res.acl_len); ++ acl_len); + } + ret = acl_len; + out_free: +-- +1.7.7.6 +