diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2008-06-19 15:21:11 -0400 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2008-06-23 17:09:06 -0400 |
| commit | b7e2445737ff69cef892b6fd9cd71cae2c9e9515 (patch) | |
| tree | d248fa5765d8e4b6ab00f10a77f9cbe793644672 /fs | |
| parent | 33852a1f2bb014e4047a844556c0d76a2f790c37 (diff) | |
| download | linux-stable-b7e2445737ff69cef892b6fd9cd71cae2c9e9515.tar.gz linux-stable-b7e2445737ff69cef892b6fd9cd71cae2c9e9515.tar.bz2 linux-stable-b7e2445737ff69cef892b6fd9cd71cae2c9e9515.zip | |
NFS: Fix filehandle size comparisons in the mount code
Fix a sign issue in xdr_decode_fhstatus3()
Fix incorrect comparison in nfs_validate_mount_data()
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfs/mount_clnt.c | 5 | ||||
| -rw-r--r-- | fs/nfs/super.c | 8 |
2 files changed, 7 insertions, 6 deletions
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c index 49c7cd0502cc..779d2eb649c5 100644 --- a/fs/nfs/mount_clnt.c +++ b/fs/nfs/mount_clnt.c @@ -130,10 +130,11 @@ static int xdr_decode_fhstatus3(struct rpc_rqst *req, __be32 *p, struct mnt_fhstatus *res) { struct nfs_fh *fh = res->fh; + unsigned size; if ((res->status = ntohl(*p++)) == 0) { - int size = ntohl(*p++); - if (size <= NFS3_FHSIZE) { + size = ntohl(*p++); + if (size <= NFS3_FHSIZE && size != 0) { fh->size = size; memcpy(fh->data, p, size); } else diff --git a/fs/nfs/super.c b/fs/nfs/super.c index dac663dc5611..614efeed5437 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -1249,13 +1249,13 @@ static int nfs_validate_mount_data(void *options, case 5: memset(data->context, 0, sizeof(data->context)); case 6: - if (data->flags & NFS_MOUNT_VER3) + if (data->flags & NFS_MOUNT_VER3) { + if (data->root.size > NFS3_FHSIZE || data->root.size == 0) + goto out_invalid_fh; mntfh->size = data->root.size; - else + } else mntfh->size = NFS2_FHSIZE; - if (mntfh->size > sizeof(mntfh->data)) - goto out_invalid_fh; memcpy(mntfh->data, data->root.data, mntfh->size); if (mntfh->size < sizeof(mntfh->data)) |