aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2008-01-26 00:02:29 -0500
committerDavid Teigland <teigland@redhat.com>2008-02-04 02:29:13 -0500
commita9cc9159281d44754f621f75d4efad0076b29db4 (patch)
tree8ee69182283251b06ed725dcd1fa0ed3c05423ec /fs
parentef58bccab7c7ef34451aa4ceea39545ef126b666 (diff)
dlm: fix overflows when copying from ->m_extra to lvb
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David Teigland <teigland@redhat.com>
Diffstat (limited to 'fs')
-rw-r--r--fs/dlm/lock.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index 6d98cf9d043d..5b82187e0221 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -1226,6 +1226,8 @@ static void set_lvb_lock_pc(struct dlm_rsb *r, struct dlm_lkb *lkb,
1226 b = dlm_lvb_operations[lkb->lkb_grmode + 1][lkb->lkb_rqmode + 1]; 1226 b = dlm_lvb_operations[lkb->lkb_grmode + 1][lkb->lkb_rqmode + 1];
1227 if (b == 1) { 1227 if (b == 1) {
1228 int len = receive_extralen(ms); 1228 int len = receive_extralen(ms);
1229 if (len > DLM_RESNAME_MAXLEN)
1230 len = DLM_RESNAME_MAXLEN;
1229 memcpy(lkb->lkb_lvbptr, ms->m_extra, len); 1231 memcpy(lkb->lkb_lvbptr, ms->m_extra, len);
1230 lkb->lkb_lvbseq = ms->m_lvbseq; 1232 lkb->lkb_lvbseq = ms->m_lvbseq;
1231 } 1233 }
@@ -2993,6 +2995,8 @@ static int receive_lvb(struct dlm_ls *ls, struct dlm_lkb *lkb,
2993 if (!lkb->lkb_lvbptr) 2995 if (!lkb->lkb_lvbptr)
2994 return -ENOMEM; 2996 return -ENOMEM;
2995 len = receive_extralen(ms); 2997 len = receive_extralen(ms);
2998 if (len > DLM_RESNAME_MAXLEN)
2999 len = DLM_RESNAME_MAXLEN;
2996 memcpy(lkb->lkb_lvbptr, ms->m_extra, len); 3000 memcpy(lkb->lkb_lvbptr, ms->m_extra, len);
2997 } 3001 }
2998 return 0; 3002 return 0;