diff options
author | Sachin Prabhu <sprabhu@redhat.com> | 2012-04-17 09:36:40 -0400 |
---|---|---|
committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2012-04-27 14:09:53 -0400 |
commit | 5794d21ef4639f0e33440927bb903f9598c21e92 (patch) | |
tree | d4bdbde63624df6e970751f46fd6fe0dacb8718c /fs/nfs/nfs4xdr.c | |
parent | 5a00689930ab975fdd1b37b034475017e460cf2a (diff) |
Avoid beyond bounds copy while caching ACL
When attempting to cache ACLs returned from the server, if the bitmap
size + the ACL size is greater than a PAGE_SIZE but the ACL size itself
is smaller than a PAGE_SIZE, we can read past the buffer page boundary.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Reported-by: Jian Li <jiali@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs/nfs/nfs4xdr.c')
-rw-r--r-- | fs/nfs/nfs4xdr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index 9312dd78d349..203c0967451b 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c | |||
@@ -4940,7 +4940,7 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req, | |||
4940 | res->acl_len = attrlen; | 4940 | res->acl_len = attrlen; |
4941 | goto out; | 4941 | goto out; |
4942 | } | 4942 | } |
4943 | dprintk("NFS: acl reply: attrlen %zu > page_len %u\n", | 4943 | dprintk("NFS: acl reply: attrlen %u > page_len %zu\n", |
4944 | attrlen, page_len); | 4944 | attrlen, page_len); |
4945 | return -EINVAL; | 4945 | return -EINVAL; |
4946 | } | 4946 | } |