nfsd4_vbuf_to_stream() uses a raw memcpy() for the first fragment of an
attribute value. xdr_reserve_space() aligns the reservation but does not
initialize the extra bytes. If the complete value fits in that fragment,
the loop that clears padding for the final fragment is never entered.

A remote client reading an attribute whose length is not a multiple of
four can therefore receive one to three stale bytes from the response
page.

Encode the first fragment with xdr_encode_opaque_fixed(), matching the
final-fragment path and ensuring that any XDR padding is zeroed.

Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 fs/nfsd/nfs4xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index e17488a911..51ab68ffdf 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5953,7 +5953,7 @@ nfsd4_vbuf_to_stream(struct xdr_stream *xdr, char *buf, u32 buflen)
 	if (!p)
 		return nfserr_resource;
 
-	memcpy(p, buf, cplen);
+	xdr_encode_opaque_fixed(p, buf, cplen);
 	buf += cplen;
 	buflen -= cplen;
 
-- 
2.43.0

On Tue, 15 Sep 2026 13:01:19 -0300, Aldo Ariel Panzardo wrote:
> nfsd4_vbuf_to_stream() uses a raw memcpy() for the first fragment of an
> attribute value. xdr_reserve_space() aligns the reservation but does not
> initialize the extra bytes. If the complete value fits in that fragment,
> the loop that clears padding for the final fragment is never entered.
> 
> A remote client reading an attribute whose length is not a multiple of
> four can therefore receive one to three stale bytes from the response
> page.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: clear XDR padding in GETXATTR replies
      commit: 37f0c2bea92e2c37a3ea0bb93a357336883a84a4

--
Chuck Lever

On Tue, 2026-09-15 at 13:01 -0300, Aldo Ariel Panzardo wrote:
> nfsd4_vbuf_to_stream() uses a raw memcpy() for the first fragment of an
> attribute value. xdr_reserve_space() aligns the reservation but does not
> initialize the extra bytes. If the complete value fits in that fragment,
> the loop that clears padding for the final fragment is never entered.
> 
> A remote client reading an attribute whose length is not a multiple of
> four can therefore receive one to three stale bytes from the response
> page.
> 
> Encode the first fragment with xdr_encode_opaque_fixed(), matching the
> final-fragment path and ensuring that any XDR padding is zeroed.
> 
> Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
> Cc: stable@vger.kernel.org
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> ---
>  fs/nfsd/nfs4xdr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index e17488a911..51ab68ffdf 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -5953,7 +5953,7 @@ nfsd4_vbuf_to_stream(struct xdr_stream *xdr, char *buf, u32 buflen)
>  	if (!p)
>  		return nfserr_resource;
>  
> -	memcpy(p, buf, cplen);
> +	xdr_encode_opaque_fixed(p, buf, cplen);
>  	buf += cplen;
>  	buflen -= cplen;
>  

Looks good. There is another memcpy() inside the loop just after this
that probably ought to be converted this way too, but it's not strictly
required to fix this bug. Maybe send a follow-on patch if you're
inclined?

Reviewed-by: Jeff Layton <jlayton@kernel.org>