diff options
author | Mi Jinlong <mijinlong@cn.fujitsu.com> | 2011-03-10 23:13:55 -0500 |
---|---|---|
committer | J. Bruce Fields <bfields@redhat.com> | 2011-03-17 13:09:19 -0400 |
commit | 5a02ab7c3c4580f94d13c683721039855b67cda6 (patch) | |
tree | b9a4a8814f4dce7086ae2d0c3d43863d6187aaa1 /fs/nfsd/nfs4xdr.c | |
parent | cf507b6f8ebae89c0e7bbd00abc6d8887c9035b1 (diff) |
nfsd: wrong index used in inner loop
We must not use dummy for index.
After the first index, READ32(dummy) will change dummy!!!!
Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com>
[bfields@redhat.com: Trond points out READ_BUF alone is sufficient.]
Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs/nfsd/nfs4xdr.c')
-rw-r--r-- | fs/nfsd/nfs4xdr.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index 615f0a9f0600..c6766af00d98 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c | |||
@@ -1142,7 +1142,7 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp, | |||
1142 | 1142 | ||
1143 | u32 dummy; | 1143 | u32 dummy; |
1144 | char *machine_name; | 1144 | char *machine_name; |
1145 | int i, j; | 1145 | int i; |
1146 | int nr_secflavs; | 1146 | int nr_secflavs; |
1147 | 1147 | ||
1148 | READ_BUF(16); | 1148 | READ_BUF(16); |
@@ -1215,8 +1215,6 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp, | |||
1215 | READ_BUF(4); | 1215 | READ_BUF(4); |
1216 | READ32(dummy); | 1216 | READ32(dummy); |
1217 | READ_BUF(dummy * 4); | 1217 | READ_BUF(dummy * 4); |
1218 | for (j = 0; j < dummy; ++j) | ||
1219 | READ32(dummy); | ||
1220 | break; | 1218 | break; |
1221 | case RPC_AUTH_GSS: | 1219 | case RPC_AUTH_GSS: |
1222 | dprintk("RPC_AUTH_GSS callback secflavor " | 1220 | dprintk("RPC_AUTH_GSS callback secflavor " |
@@ -1232,7 +1230,6 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp, | |||
1232 | READ_BUF(4); | 1230 | READ_BUF(4); |
1233 | READ32(dummy); | 1231 | READ32(dummy); |
1234 | READ_BUF(dummy); | 1232 | READ_BUF(dummy); |
1235 | p += XDR_QUADLEN(dummy); | ||
1236 | break; | 1233 | break; |
1237 | default: | 1234 | default: |
1238 | dprintk("Illegal callback secflavor\n"); | 1235 | dprintk("Illegal callback secflavor\n"); |