aboutsummaryrefslogtreecommitdiffstats
path: root/fs/nfsd/nfs4xdr.c
diff options
context:
space:
mode:
Diffstat (limited to 'fs/nfsd/nfs4xdr.c')
-rw-r--r--fs/nfsd/nfs4xdr.c15
1 files changed, 7 insertions, 8 deletions
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index a1c48b4111d2..3d0749633d2b 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -598,20 +598,19 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
598 switch (create->cr_type) { 598 switch (create->cr_type) {
599 case NF4LNK: 599 case NF4LNK:
600 READ_BUF(4); 600 READ_BUF(4);
601 create->cr_linklen = be32_to_cpup(p++); 601 create->cr_datalen = be32_to_cpup(p++);
602 READ_BUF(create->cr_linklen); 602 READ_BUF(create->cr_datalen);
603 /* 603 /*
604 * The VFS will want a null-terminated string, and 604 * The VFS will want a null-terminated string, and
605 * null-terminating in place isn't safe since this might 605 * null-terminating in place isn't safe since this might
606 * end on a page boundary: 606 * end on a page boundary:
607 */ 607 */
608 create->cr_linkname = 608 create->cr_data = kmalloc(create->cr_datalen + 1, GFP_KERNEL);
609 kmalloc(create->cr_linklen + 1, GFP_KERNEL); 609 if (!create->cr_data)
610 if (!create->cr_linkname)
611 return nfserr_jukebox; 610 return nfserr_jukebox;
612 memcpy(create->cr_linkname, p, create->cr_linklen); 611 memcpy(create->cr_data, p, create->cr_datalen);
613 create->cr_linkname[create->cr_linklen] = '\0'; 612 create->cr_data[create->cr_datalen] = '\0';
614 defer_free(argp, kfree, create->cr_linkname); 613 defer_free(argp, kfree, create->cr_data);
615 break; 614 break;
616 case NF4BLK: 615 case NF4BLK:
617 case NF4CHR: 616 case NF4CHR: