nfsd4_vbuf_to_stream() uses a raw memcpy() for the first fragment of an attribute value. xdr_reserve_space() aligns the reservation but does not initialize the extra bytes. If the complete value fits in that fragment, the loop that clears padding for the final fragment is never entered. A remote client reading an attribute whose length is not a multiple of four can therefore receive one to three stale bytes from the response page. Encode the first fragment with xdr_encode_opaque_fixed(), matching the final-fragment path and ensuring that any XDR padding is zeroed. Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic") Cc: stable@vger.kernel.org Signed-off-by: Aldo Ariel Panzardo --- fs/nfsd/nfs4xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index e17488a911..51ab68ffdf 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -5953,7 +5953,7 @@ nfsd4_vbuf_to_stream(struct xdr_stream *xdr, char *buf, u32 buflen) if (!p) return nfserr_resource; - memcpy(p, buf, cplen); + xdr_encode_opaque_fixed(p, buf, cplen); buf += cplen; buflen -= cplen; -- 2.43.0