nfsd: propagate SETXATTR value decode errors

[PATCH] nfsd: propagate SETXATTR value decode errors

Posted by Aldo Ariel Panzardo 1 week, 2 days ago

nfsd4_decode_setxattr() stores the status returned while assembling a
non-empty attribute value, but then unconditionally returns nfs_ok. An
allocation failure can therefore leave a NULL value buffer paired with a
non-zero length and allow compound processing to continue.

Return the decoder status so that the operation stops on the original
error.

Fixes: 403366a7e8e2 ("NFSD: Replace READ* macros in nfsd4_decode_setxattr()")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 fs/nfsd/nfs4xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index e17488a911..27c1b42384 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2435,7 +2435,7 @@ nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
 						&setxattr->setxa_buf, size);
 	}
 
-	return nfs_ok;
+	return status;
 }
 
 static __be32
-- 
2.43.0

Re: [PATCH] nfsd: propagate SETXATTR value decode errors

Posted by Chuck Lever 1 week, 2 days ago

On Tue, 15 Sep 2026 09:56:36 -0300, Aldo Ariel Panzardo wrote:
> nfsd4_decode_setxattr() stores the status returned while assembling a
> non-empty attribute value, but then unconditionally returns nfs_ok. An
> allocation failure can therefore leave a NULL value buffer paired with a
> non-zero length and allow compound processing to continue.
> 
> Return the decoder status so that the operation stops on the original
> error.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: propagate SETXATTR value decode errors
      commit: f6c38392f815da751d4330adad2b937586a0f0fa

--
Chuck Lever

Re: [PATCH] nfsd: propagate SETXATTR value decode errors

Posted by Jeff Layton 1 week, 2 days ago

On Tue, 2026-09-15 at 09:56 -0300, Aldo Ariel Panzardo wrote:
> nfsd4_decode_setxattr() stores the status returned while assembling a
> non-empty attribute value, but then unconditionally returns nfs_ok. An
> allocation failure can therefore leave a NULL value buffer paired with a
> non-zero length and allow compound processing to continue.
> 
> Return the decoder status so that the operation stops on the original
> error.
> 
> Fixes: 403366a7e8e2 ("NFSD: Replace READ* macros in nfsd4_decode_setxattr()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> ---
>  fs/nfsd/nfs4xdr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index e17488a911..27c1b42384 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -2435,7 +2435,7 @@ nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
>  						&setxattr->setxa_buf, size);
>  	}
>  
> -	return nfs_ok;
> +	return status;
>  }
>  
>  static __be32

Nice catch.

Reviewed-by: Jeff Layton <jlayton@kernel.org>