diff options
Diffstat (limited to 'fs/nfsd/nfsxdr.c')
| -rw-r--r-- | fs/nfsd/nfsxdr.c | 13 |
1 files changed, 3 insertions, 10 deletions
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c index 6a4947a3f4fa..de07ff625777 100644 --- a/fs/nfsd/nfsxdr.c +++ b/fs/nfsd/nfsxdr.c | |||
| @@ -257,9 +257,6 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p, | |||
| 257 | len = args->count = ntohl(*p++); | 257 | len = args->count = ntohl(*p++); |
| 258 | p++; /* totalcount - unused */ | 258 | p++; /* totalcount - unused */ |
| 259 | 259 | ||
| 260 | if (!xdr_argsize_check(rqstp, p)) | ||
| 261 | return 0; | ||
| 262 | |||
| 263 | len = min_t(unsigned int, len, NFSSVC_MAXBLKSIZE_V2); | 260 | len = min_t(unsigned int, len, NFSSVC_MAXBLKSIZE_V2); |
| 264 | 261 | ||
| 265 | /* set up somewhere to store response. | 262 | /* set up somewhere to store response. |
| @@ -275,7 +272,7 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p, | |||
| 275 | v++; | 272 | v++; |
| 276 | } | 273 | } |
| 277 | args->vlen = v; | 274 | args->vlen = v; |
| 278 | return 1; | 275 | return xdr_argsize_check(rqstp, p); |
| 279 | } | 276 | } |
| 280 | 277 | ||
| 281 | int | 278 | int |
| @@ -365,11 +362,9 @@ nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd_readli | |||
| 365 | p = decode_fh(p, &args->fh); | 362 | p = decode_fh(p, &args->fh); |
| 366 | if (!p) | 363 | if (!p) |
| 367 | return 0; | 364 | return 0; |
| 368 | if (!xdr_argsize_check(rqstp, p)) | ||
| 369 | return 0; | ||
| 370 | args->buffer = page_address(*(rqstp->rq_next_page++)); | 365 | args->buffer = page_address(*(rqstp->rq_next_page++)); |
| 371 | 366 | ||
| 372 | return 1; | 367 | return xdr_argsize_check(rqstp, p); |
| 373 | } | 368 | } |
| 374 | 369 | ||
| 375 | int | 370 | int |
| @@ -407,11 +402,9 @@ nfssvc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p, | |||
| 407 | args->cookie = ntohl(*p++); | 402 | args->cookie = ntohl(*p++); |
| 408 | args->count = ntohl(*p++); | 403 | args->count = ntohl(*p++); |
| 409 | args->count = min_t(u32, args->count, PAGE_SIZE); | 404 | args->count = min_t(u32, args->count, PAGE_SIZE); |
| 410 | if (!xdr_argsize_check(rqstp, p)) | ||
| 411 | return 0; | ||
| 412 | args->buffer = page_address(*(rqstp->rq_next_page++)); | 405 | args->buffer = page_address(*(rqstp->rq_next_page++)); |
| 413 | 406 | ||
| 414 | return 1; | 407 | return xdr_argsize_check(rqstp, p); |
| 415 | } | 408 | } |
| 416 | 409 | ||
| 417 | /* | 410 | /* |
