diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2010-12-14 09:58:01 -0500 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2010-12-16 12:37:24 -0500 |
| commit | 8111f373600cd43b3198b48b9238e3ad2fd9908d (patch) | |
| tree | 5f4c1751405da033a1987de47b90598f08f3b6c6 /fs | |
| parent | d8367c504e39528a057a5d7a267b6724f7fdb4b8 (diff) | |
NFS: Fix hdrlen calculation in NFSv4's decode_read()
When computing the length of the header, be sure to include the
four octets consumed by "count".
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfs/nfs4xdr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index a48a43c75111..868815c55450 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c | |||
| @@ -4475,7 +4475,7 @@ static int decode_read(struct xdr_stream *xdr, struct rpc_rqst *req, struct nfs_ | |||
| 4475 | goto out_overflow; | 4475 | goto out_overflow; |
| 4476 | eof = be32_to_cpup(p++); | 4476 | eof = be32_to_cpup(p++); |
| 4477 | count = be32_to_cpup(p); | 4477 | count = be32_to_cpup(p); |
| 4478 | hdrlen = (u8 *) p - (u8 *) iov->iov_base; | 4478 | hdrlen = (u8 *) xdr->p - (u8 *) iov->iov_base; |
| 4479 | recvd = req->rq_rcv_buf.len - hdrlen; | 4479 | recvd = req->rq_rcv_buf.len - hdrlen; |
| 4480 | if (count > recvd) { | 4480 | if (count > recvd) { |
| 4481 | dprintk("NFS: server cheating in read reply: " | 4481 | dprintk("NFS: server cheating in read reply: " |