* [PATCH] nfsd: propagate SETXATTR value decode errors
@ 2026-09-15 12:56 Aldo Ariel Panzardo
2026-09-15 13:34 ` Jeff Layton
2026-09-15 13:56 ` Chuck Lever
0 siblings, 2 replies; 3+ messages in thread
From: Aldo Ariel Panzardo @ 2026-09-15 12:56 UTC (permalink / raw)
To: Chuck Lever, Jeff Layton
Cc: linux-nfs, linux-kernel, stable, Aldo Ariel Panzardo
nfsd4_decode_setxattr() stores the status returned while assembling a
non-empty attribute value, but then unconditionally returns nfs_ok. An
allocation failure can therefore leave a NULL value buffer paired with a
non-zero length and allow compound processing to continue.
Return the decoder status so that the operation stops on the original
error.
Fixes: 403366a7e8e2 ("NFSD: Replace READ* macros in nfsd4_decode_setxattr()")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
fs/nfsd/nfs4xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index e17488a911..27c1b42384 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2435,7 +2435,7 @@ nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
&setxattr->setxa_buf, size);
}
- return nfs_ok;
+ return status;
}
static __be32
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] nfsd: propagate SETXATTR value decode errors
2026-09-15 12:56 [PATCH] nfsd: propagate SETXATTR value decode errors Aldo Ariel Panzardo
@ 2026-09-15 13:34 ` Jeff Layton
2026-09-15 13:56 ` Chuck Lever
1 sibling, 0 replies; 3+ messages in thread
From: Jeff Layton @ 2026-09-15 13:34 UTC (permalink / raw)
To: Aldo Ariel Panzardo, Chuck Lever; +Cc: linux-nfs, linux-kernel, stable
On Tue, 2026-09-15 at 09:56 -0300, Aldo Ariel Panzardo wrote:
> nfsd4_decode_setxattr() stores the status returned while assembling a
> non-empty attribute value, but then unconditionally returns nfs_ok. An
> allocation failure can therefore leave a NULL value buffer paired with a
> non-zero length and allow compound processing to continue.
>
> Return the decoder status so that the operation stops on the original
> error.
>
> Fixes: 403366a7e8e2 ("NFSD: Replace READ* macros in nfsd4_decode_setxattr()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> ---
> fs/nfsd/nfs4xdr.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index e17488a911..27c1b42384 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -2435,7 +2435,7 @@ nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
> &setxattr->setxa_buf, size);
> }
>
> - return nfs_ok;
> + return status;
> }
>
> static __be32
Nice catch.
Reviewed-by: Jeff Layton <jlayton@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] nfsd: propagate SETXATTR value decode errors
2026-09-15 12:56 [PATCH] nfsd: propagate SETXATTR value decode errors Aldo Ariel Panzardo
2026-09-15 13:34 ` Jeff Layton
@ 2026-09-15 13:56 ` Chuck Lever
1 sibling, 0 replies; 3+ messages in thread
From: Chuck Lever @ 2026-09-15 13:56 UTC (permalink / raw)
To: Jeff Layton, Chuck Lever, Aldo Ariel Panzardo
Cc: linux-nfs, linux-kernel, stable
On Tue, 15 Sep 2026 09:56:36 -0300, Aldo Ariel Panzardo wrote:
> nfsd4_decode_setxattr() stores the status returned while assembling a
> non-empty attribute value, but then unconditionally returns nfs_ok. An
> allocation failure can therefore leave a NULL value buffer paired with a
> non-zero length and allow compound processing to continue.
>
> Return the decoder status so that the operation stops on the original
> error.
>
> [...]
Applied to nfsd-testing, thanks!
[1/1] nfsd: propagate SETXATTR value decode errors
commit: f6c38392f815da751d4330adad2b937586a0f0fa
--
Chuck Lever
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-15 13:56 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-15 12:56 [PATCH] nfsd: propagate SETXATTR value decode errors Aldo Ariel Panzardo
2026-09-15 13:34 ` Jeff Layton
2026-09-15 13:56 ` Chuck Lever
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®