diff options
author | Chuck Lever <chuck.lever@oracle.com> | 2007-09-11 18:00:20 -0400 |
---|---|---|
committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2007-10-09 17:16:42 -0400 |
commit | 06b8d2552d50f802a3277137a565febcd59ef037 (patch) | |
tree | 7b3b5d92e4a7a1bd8eff9e994a4c1899a8c35670 | |
parent | 6d0aa06afd62a868d83c6021335622a316469527 (diff) |
SUNRPC: Make sure server name is reasonable before trying to print it
Check the length of the passed-in server name before trying to print it in
the log.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
-rw-r--r-- | net/sunrpc/clnt.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index c3d571abcded..0357819ffdb0 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c | |||
@@ -127,7 +127,14 @@ static struct rpc_clnt * rpc_new_client(struct rpc_xprt *xprt, char *servname, s | |||
127 | struct rpc_clnt *clnt = NULL; | 127 | struct rpc_clnt *clnt = NULL; |
128 | struct rpc_auth *auth; | 128 | struct rpc_auth *auth; |
129 | int err; | 129 | int err; |
130 | int len; | 130 | size_t len; |
131 | |||
132 | /* sanity check the name before trying to print it */ | ||
133 | err = -EINVAL; | ||
134 | len = strlen(servname); | ||
135 | if (len > RPC_MAXNETNAMELEN) | ||
136 | goto out_no_rpciod; | ||
137 | len++; | ||
131 | 138 | ||
132 | dprintk("RPC: creating %s client for %s (xprt %p)\n", | 139 | dprintk("RPC: creating %s client for %s (xprt %p)\n", |
133 | program->name, servname, xprt); | 140 | program->name, servname, xprt); |
@@ -148,7 +155,6 @@ static struct rpc_clnt * rpc_new_client(struct rpc_xprt *xprt, char *servname, s | |||
148 | clnt->cl_parent = clnt; | 155 | clnt->cl_parent = clnt; |
149 | 156 | ||
150 | clnt->cl_server = clnt->cl_inline_name; | 157 | clnt->cl_server = clnt->cl_inline_name; |
151 | len = strlen(servname) + 1; | ||
152 | if (len > sizeof(clnt->cl_inline_name)) { | 158 | if (len > sizeof(clnt->cl_inline_name)) { |
153 | char *buf = kmalloc(len, GFP_KERNEL); | 159 | char *buf = kmalloc(len, GFP_KERNEL); |
154 | if (buf != 0) | 160 | if (buf != 0) |