Re: [PATCH] nfsd: propagate SETXATTR value decode errors

[Jeff Layton]

On Tue, 2026-09-15 at 09:56 -0300, Aldo Ariel Panzardo wrote:
> nfsd4_decode_setxattr() stores the status returned while assembling a
> non-empty attribute value, but then unconditionally returns nfs_ok. An
> allocation failure can therefore leave a NULL value buffer paired with a
> non-zero length and allow compound processing to continue.
> 
> Return the decoder status so that the operation stops on the original
> error.
> 
> Fixes: 403366a7e8e2 ("NFSD: Replace READ* macros in nfsd4_decode_setxattr()")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>
> ---
>  fs/nfsd/nfs4xdr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index e17488a911..27c1b42384 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -2435,7 +2435,7 @@ nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
>  						&setxattr->setxa_buf, size);
>  	}
>  
> -	return nfs_ok;
> +	return status;
>  }
>  
>  static __be32

Nice catch.

Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>